VDB
RHSA-2026:86093
RHSA-2026:86093
PUBLISHED
CVSS 6.800000190734863 MEDIUM
A flaw was found in the Go net/http package. A remote attacker can cause a Denial of Service (DoS) by sending an HTTP request containing a Range header with a large number of small byte ranges. When the server processes these ranges while serving content, it consumes an excessive amount of CPU resources, rendering the application unresponsive to legitimate users.
Risk Scores
CVSS 3.1
6.800000190734863
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | golang-bin-0:1.26.10-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10) | 1.26.10-1.el10 |
| Red Hat | golang-0:1.26.10-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10) | 1.26.10-1.el10 |
| Red Hat | golang-race-0:1.26.10-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10) | 1.26.10-1.el10 |
| Red Hat | golang-0:1.26.10-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10) | 1.26.10-1.el10 |
| Red Hat | golang-race-0:1.26.10-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10) | 1.26.10-1.el10 |
| Red Hat | go-toolset-0:1.26.10-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10) | 1.26.10-1.el10 |
| Red Hat | golang-0:1.26.10-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10) | 1.26.10-1.el10 |
| Red Hat | golang-bin-0:1.26.10-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10) | 1.26.10-1.el10 |
| Red Hat | golang-race-0:1.26.10-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10) | 1.26.10-1.el10 |
| Red Hat | golang-misc-0:1.26.10-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10) | 1.26.10-1.el10 |
| Red Hat | golang-bin-0:1.26.10-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10) | 1.26.10-1.el10 |
| Red Hat | golang-src-0:1.26.10-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10) | 1.26.10-1.el10 |
| Red Hat | go-toolset-0:1.26.10-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10) | 1.26.10-1.el10 |
| Red Hat | golang-tests-0:1.26.10-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10) | 1.26.10-1.el10 |
| Red Hat | golang-race-0:1.26.10-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10) | 1.26.10-1.el10 |
| Red Hat | golang-0:1.26.10-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10) | 1.26.10-1.el10 |
| Red Hat | golang-bin-0:1.26.10-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10) | 1.26.10-1.el10 |
| Red Hat | golang-0:1.26.10-1.el10_2.src as a component of Red Hat Enterprise Linux AppStream (v. 10) | 1.26.10-1.el10 |
| Red Hat | go-toolset-0:1.26.10-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10) | 1.26.10-1.el10 |
| Red Hat | go-toolset-0:1.26.10-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10) | 1.26.10-1.el10 |
…and 1 more
Timeline
- Oct 20, 2026 CVE Published
- Oct 22, 2026 CVE Updated
- Oct 22, 2026 Distribution Patch
- Oct 22, 2026 Distribution Patch
- Oct 22, 2026 Security Advisory
- Oct 22, 2026 Security Advisory
- Oct 22, 2026 Security Advisory
- Oct 22, 2026 Security Advisory
- Oct 22, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:86093 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2548334 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2548336 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2548344 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2556068 issue
- https://issues.redhat.com/browse/RHEL-287191 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_86093.json advisory
- https://access.redhat.com/security/cve/CVE-2026-78667 advisory
- https://www.cve.org/CVERecord?id=CVE-2026-78667 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-78667 advisory
- https://go.dev/cl/847309 advisory
- https://go.dev/issue/81858 advisory
- https://groups.google.com/g/golang-announce/c/U2fTuyDJznI advisory
- https://pkg.go.dev/vuln/GO-2026-6609 advisory
- https://access.redhat.com/security/cve/CVE-2026-78669 advisory
- https://www.cve.org/CVERecord?id=CVE-2026-78669 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-78669 advisory
- https://go.dev/cl/847186 advisory
- https://go.dev/cl/847308 advisory
…and 15 more