VDB
RHSA-2026:86203
RHSA-2026:86203
PUBLISHED
CVSS 6.800000190734863 MEDIUM
A flaw was found in the Go net/http package. A remote attacker can cause a Denial of Service (DoS) by sending an HTTP request containing a Range header with a large number of small byte ranges. When the server processes these ranges while serving content, it consumes an excessive amount of CPU resources, rendering the application unresponsive to legitimate users.
Risk Scores
CVSS 3.1
6.800000190734863
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | delve-debuginfo-0:1.26.1-1.module+el8.10.0+24516+40554724.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8) | 0:1.26.1-1.module+el8.10.0+24516+40554724 |
| Red Hat | go-toolset-0:1.26.10-1.module+el8.10.0+25107+6b50279c.ppc64le (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8) | 0:1.26.10-1.module+el8.10.0+25107+6b50279c |
| Red Hat | golang-race-0:1.26.10-1.module+el8.10.0+25107+6b50279c.s390x (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8) | 0:1.26.10-1.module+el8.10.0+25107+6b50279c |
| Red Hat | golang-docs-0:1.26.10-1.module+el8.10.0+25107+6b50279c.noarch (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8) | 0:1.26.10-1.module+el8.10.0+25107+6b50279c |
| Red Hat | golang-bin-0:1.26.10-1.module+el8.10.0+25107+6b50279c.ppc64le (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8) | 0:1.26.10-1.module+el8.10.0+25107+6b50279c |
| Red Hat | delve-debugsource-0:1.26.1-1.module+el8.10.0+24516+40554724.ppc64le (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8) | 0:1.26.1-1.module+el8.10.0+24516+40554724 |
| Red Hat | delve-debuginfo-0:1.26.1-1.module+el8.10.0+24516+40554724.aarch64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8) | 0:1.26.1-1.module+el8.10.0+24516+40554724 |
| Red Hat | go-toolset-0:1.26.10-1.module+el8.10.0+25107+6b50279c.s390x (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8) | 0:1.26.10-1.module+el8.10.0+25107+6b50279c |
| Red Hat | golang-tests-0:1.26.10-1.module+el8.10.0+25107+6b50279c.noarch (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8) | 0:1.26.10-1.module+el8.10.0+25107+6b50279c |
| Red Hat | delve-0:1.26.1-1.module+el8.10.0+24516+40554724.aarch64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8) | 0:1.26.1-1.module+el8.10.0+24516+40554724 |
| Red Hat | golang-0:1.26.10-1.module+el8.10.0+25107+6b50279c.ppc64le (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8) | 0:1.26.10-1.module+el8.10.0+25107+6b50279c |
| Red Hat | delve-0:1.26.1-1.module+el8.10.0+24516+40554724.src (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8) | 0:1.26.1-1.module+el8.10.0+24516+40554724 |
| Red Hat | golang-race-0:1.26.10-1.module+el8.10.0+25107+6b50279c.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8) | 0:1.26.10-1.module+el8.10.0+25107+6b50279c |
| Red Hat | golang-0:1.26.10-1.module+el8.10.0+25107+6b50279c.src (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8) | 0:1.26.10-1.module+el8.10.0+25107+6b50279c |
| Red Hat | delve-debugsource-0:1.26.1-1.module+el8.10.0+24516+40554724.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8) | 0:1.26.1-1.module+el8.10.0+24516+40554724 |
| Red Hat | golang-bin-0:1.26.10-1.module+el8.10.0+25107+6b50279c.aarch64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8) | 0:1.26.10-1.module+el8.10.0+25107+6b50279c |
| Red Hat | golang-race-0:1.26.10-1.module+el8.10.0+25107+6b50279c.ppc64le (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8) | 0:1.26.10-1.module+el8.10.0+25107+6b50279c |
| Red Hat | golang-0:1.26.10-1.module+el8.10.0+25107+6b50279c.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8) | 0:1.26.10-1.module+el8.10.0+25107+6b50279c |
| Red Hat | golang-race-0:1.26.10-1.module+el8.10.0+25107+6b50279c.aarch64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8) | 0:1.26.10-1.module+el8.10.0+25107+6b50279c |
| Red Hat | golang-bin-0:1.26.10-1.module+el8.10.0+25107+6b50279c.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8) | 0:1.26.10-1.module+el8.10.0+25107+6b50279c |
…and 11 more
Timeline
- Oct 20, 2026 CVE Published
- Oct 22, 2026 CVE Updated
- Oct 22, 2026 Distribution Patch
- Oct 22, 2026 Distribution Patch
- Oct 22, 2026 Security Advisory
- Oct 22, 2026 Security Advisory
- Oct 22, 2026 Security Advisory
- Oct 22, 2026 Security Advisory
- Oct 22, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:86203 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2548334 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2548336 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2548344 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2556068 issue
- https://issues.redhat.com/browse/RHEL-287193 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_86203.json advisory
- https://access.redhat.com/security/cve/CVE-2026-78667 advisory
- https://www.cve.org/CVERecord?id=CVE-2026-78667 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-78667 advisory
- https://go.dev/cl/847309 advisory
- https://go.dev/issue/81858 advisory
- https://groups.google.com/g/golang-announce/c/U2fTuyDJznI advisory
- https://pkg.go.dev/vuln/GO-2026-6609 advisory
- https://access.redhat.com/security/cve/CVE-2026-78669 advisory
- https://www.cve.org/CVERecord?id=CVE-2026-78669 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-78669 advisory
- https://go.dev/cl/847186 advisory
- https://go.dev/cl/847308 advisory
…and 15 more