← Database

CVE-2026-97054

N/A CVSS: N/A Published: 2026-11-11 Modified: 2026-11-11

Description

For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header.

Affected Platforms

Unknown

Weakness Type

Unknown

References