VDB
CVE-2026-78667
CVE-2026-78667
PUBLISHED
CVSS 7.5 HIGH
Reported by Go · Published October 8, 2026
When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Go standard library | net/http | 0, 1.27.0-0 |
| wolfi | yam | * |
| chainguard | json-exporter | * |
| chainguard | neuvector | * |
| wolfi | metacontroller | * |
| chainguard | trivy-k8s-wrapper-fips | * |
| chainguard | victoriametrics | * |
| wolfi | opentofu-1.11 | * |
| chainguard | crossplane-provider-aws-sesv2-fips | * |
| chainguard | gcp-compute-persistent-disk-csi-driver-1.23 | * |
| chainguard | trillian | * |
| chainguard | kubernetes-csi-livenessprobe-fips-2.10 | * |
| chainguard | aws-ebs-csi-driver-fips-1.57 | * |
| wolfi | rclone | 0 |
| wolfi | nri-mongodb | * |
| chainguard | crossplane-provider-terraform-fips | * |
| wolfi | wait-for-port | * |
| chainguard | ocm-cli | * |
| chainguard | tekton-chains-fips | * |
| chainguard | grafana-loki-datasource-fips | * |
…and 2399 more
Timeline
- Oct 8, 2026 CVE Published
- Oct 9, 2026 EPSS Score
- Oct 9, 2026 Coalition ESS Score
- Oct 9, 2026 CVE Updated
- Oct 10, 2026 EPSS Score
- Oct 13, 2026 EPSS Score
- Oct 14, 2026 EPSS Score
- Oct 16, 2026 EPSS Score
- Oct 20, 2026 EPSS Score
- Oct 21, 2026 EPSS Score
- Oct 21, 2026 Distribution Patch
- Oct 21, 2026 Security Advisory