UBUNTU-CVE-2026-97054: Medium severity ubuntu/golang-1.10 vulnerability
For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
HTTP/1 servers are affected when they use MaxBytesReader or MaxBytesHandler and the handler concurrently reads the request body while writing response headers. The listed Ubuntu golang packages are golang-1.6, golang-1.8, golang-1.10, golang-1.13, golang-1.16, golang-1.18, golang-1.22, and golang-1.24.
What must occur for an attacker to trigger the crash?
The request body must exceed the MaxBytesReader limit while the server handler is reading that body concurrently with writing the response header. This can race with the automatic setting of the Connection: close header and cause a runtime panic.
Is a default HTTP/1 server configuration affected?
The available information only identifies servers that use MaxBytesReader or MaxBytesHandler in a handler pattern that concurrently reads the request body and writes response headers. It does not establish that default server configurations are affected.