AZL-113666: CVE-2026-97054 affecting package tensorflow 2.16.1-11
For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
HTTP/1 servers are affected when they use MaxBytesReader or MaxBytesHandler and a handler reads the request body concurrently with writing the response header. The affected package identified here is tensorflow version 2.16.1-11 for azure-linux.
What does an attacker need to do to trigger the crash?
The request body must exceed the MaxBytesReader limit while the server handler concurrently reads that body and writes response headers. The race can then cause a runtime panic and crash the HTTP/1 server.
Are default configurations known to be affected?
The available information does not establish whether the affected behavior is enabled by default. Exposure depends on use of MaxBytesReader or MaxBytesHandler and concurrent request-body reading and response-header writing.