Go net/http CVE-2026-78667

Exploitation requires that the target server use the net/http file-serving handlers FileServer, ServeContent, or ServeFile(FS) - these must be exposed and reachable for the Range-header parsing path to be triggered; a Go application that does not serve files via these handlers is not affected by this specific vector. The trigger is a single HTTP request carrying a Range header enumerating a large number of small ranges. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed, and default configurations are affected wherever these handlers are used. The limiting factor is the handler/feature dependency plus the affected version range (net/http before 1.26.9, and 1.27.0-0 before 1.27.2); impact is availability-only (CPU exhaustion), with no data compromise.

This is a resource-exhaustion denial-of-service in the Go standard library's net/http package (CWE-770, uncontrolled resource consumption). The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates a network-reachable, low-complexity, unauthenticated attack with impact confined to availability only - no confidentiality or integrity exposure. Signals are internally consistent but point to a moderate, not emergency, priority: EPSS is very low at 0.17% (6th percentile), the CVE is NOT on CISA KEV, and CISA SSVC records Exploitation as 'none' with Technical Impact 'partial' - meaning no observed exploitation and only partial (availability-degrading) impact, not full system takeover. The one amplifying signal is SSVC Automatable=yes, which fits a trivially scriptable Range-header flood. No public POC is referenced in the provided data. Net read: a legitimately exploitable, easy-to-trigger DoS against any Go HTTP server using the affected file-serving handlers, but the 7.5 'High' score overstates urgency relative to real-world exploitation evidence - this is a patch-in-normal-cycle issue absent exposure of a critical internet-facing Go service. Note the tension: high-and-automatable CVSS/SSVC versus near-zero EPSS and no KEV listing suggests broad patching will outpace any widespread exploitation.

An unauthenticated remote attacker sends HTTP requests to a Go web server whose handlers use FileServer, ServeContent, or ServeFile, each request carrying a Range header specifying a very large number of small byte ranges. The server spends excessive CPU parsing and servicing these ranges, and a modest volume of such requests degrades or exhausts server capacity, denying service to legitimate users. No authentication or user interaction is required and the attack is trivially automatable; no public exploit code is referenced in the provided data.