VDB
RHSA-2026:87911
RHSA-2026:87911
PUBLISHED
CVSS 6.800000190734863 MEDIUM
A flaw was found in the Go net/http package. A remote attacker can cause a Denial of Service (DoS) by sending an HTTP request containing a Range header with a large number of small byte ranges. When the server processes these ranges while serving content, it consumes an excessive amount of CPU resources, rendering the application unresponsive to legitimate users.
Risk Scores
CVSS 3.1
6.800000190734863
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | grafana-pcp-0:5.1.1-15.el9_6.2.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 0:5.1.1-15.el9_6.2 |
| Red Hat | grafana-pcp-debugsource-0:5.1.1-15.el9_6.2.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 0:5.1.1-15.el9_6.2 |
| Red Hat | grafana-pcp-0:5.1.1-15.el9_6.2.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 0:5.1.1-15.el9_6.2 |
| Red Hat | grafana-pcp-0:5.1.1-15.el9_6.2.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 0:5.1.1-15.el9_6.2 |
| Red Hat | grafana-pcp-debugsource-0:5.1.1-15.el9_6.2.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 0:5.1.1-15.el9_6.2 |
| Red Hat | grafana-pcp-0:5.1.1-15.el9_6.2.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 0:5.1.1-15.el9_6.2 |
| Red Hat | grafana-pcp-0:5.1.1-15.el9_6.2.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 0:5.1.1-15.el9_6.2 |
| Red Hat | grafana-pcp-debugsource-0:5.1.1-15.el9_6.2.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 0:5.1.1-15.el9_6.2 |
| Red Hat | grafana-pcp-debuginfo-0:5.1.1-15.el9_6.2.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 0:5.1.1-15.el9_6.2 |
| Red Hat | grafana-pcp-debuginfo-0:5.1.1-15.el9_6.2.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 0:5.1.1-15.el9_6.2 |
| Red Hat | grafana-pcp-debuginfo-0:5.1.1-15.el9_6.2.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 0:5.1.1-15.el9_6.2 |
| Red Hat | grafana-pcp-debugsource-0:5.1.1-15.el9_6.2.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 0:5.1.1-15.el9_6.2 |
| Red Hat | grafana-pcp-debuginfo-0:5.1.1-15.el9_6.2.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) | 0:5.1.1-15.el9_6.2 |
Timeline
- Oct 22, 2026 CVE Published
- Nov 2, 2026 CVE Updated
- Nov 2, 2026 Distribution Patch
- Nov 2, 2026 Distribution Patch
- Nov 2, 2026 Security Advisory
- Nov 2, 2026 Security Advisory
- Nov 2, 2026 Security Advisory
- Nov 2, 2026 Security Advisory
- Nov 2, 2026 Security Advisory
- Nov 2, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:87911 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2556068 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_87911.json advisory
- https://access.redhat.com/security/cve/CVE-2026-78667 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2548334 issue
- https://www.cve.org/CVERecord?id=CVE-2026-78667 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-78667 advisory
- https://go.dev/cl/847309 advisory
- https://go.dev/issue/81858 advisory
- https://groups.google.com/g/golang-announce/c/U2fTuyDJznI advisory
- https://pkg.go.dev/vuln/GO-2026-6609 advisory
- https://access.redhat.com/security/cve/CVE-2026-78669 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2548344 issue
- https://www.cve.org/CVERecord?id=CVE-2026-78669 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-78669 advisory
- https://go.dev/cl/847186 advisory
- https://go.dev/cl/847308 advisory
- https://go.dev/issue/81742 advisory
- https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs advisory
…and 22 more