GO-2026-6859: HTTP/1 server crash due to MaxBytesReader header race in net/http

Q: Which applications are exposed to this issue?

HTTP/1 servers are exposed if they use MaxBytesReader or MaxBytesHandler and a handler can read the request body concurrently with writing response headers.

Q: What condition triggers the race?

The request body must exceed the MaxBytesReader limit. When that happens, MaxBytesReader automatically sets the Connection: close response header without synchronization.

Q: What is the impact if the race occurs?

The server can terminate with a runtime panic when the automatic Connection: close header update races with another response-header update by the handler.

Q: What can be changed while a fix is unavailable?

Avoid concurrently reading the request body and writing response headers in handlers that use MaxBytesReader or MaxBytesHandler. Ensure body-limit handling completes before response headers are written.

Published Nov 11, 2026

Updated

For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header.

Affected Software

2 affected componentsFixes available

go/stdlib<1.26.11

1.26.11

go/stdlib>=1.27.0-0<1.27.4

1.27.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade go/stdlib to a version that resolves this vulnerability.
Fixed in 1.26.11
Upgrade
Upgrade go/stdlib to a version that resolves this vulnerability.
Fixed in 1.27.4

Event History

Nov 11, 2026

Advisory Published

via OSV·02:51 AM

Data Sourced

via OSV·02:51 AM

DescriptionAffected Software

Frequently Asked Questions

Which applications are exposed to this issue?

HTTP/1 servers are exposed if they use MaxBytesReader or MaxBytesHandler and a handler can read the request body concurrently with writing response headers.

What condition triggers the race?

The request body must exceed the MaxBytesReader limit. When that happens, MaxBytesReader automatically sets the Connection: close response header without synchronization.

What is the impact if the race occurs?

The server can terminate with a runtime panic when the automatic Connection: close header update races with another response-header update by the handler.

What can be changed while a fix is unavailable?

Avoid concurrently reading the request body and writing response headers in handlers that use MaxBytesReader or MaxBytesHandler. Ensure body-limit handling completes before response headers are written.

GO-2026-6859: HTTP/1 server crash due to MaxBytesReader header race in net/http

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What condition triggers the race?

What is the impact if the race occurs?

What can be changed while a fix is unavailable?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What condition triggers the race?

What is the impact if the race occurs?

What can be changed while a fix is unavailable?