CVE-2026-97054

For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can...

CVE-2026-97054

The Go standard library 's net/http package is vulnerable to a race condition in HTTP/1 servers . When a MaxBytesReader or MaxBytesHandler exceeds its limit, the

CVE-2026-97054

For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can...

CVE-2026-97054 HTTP/1 server crash due to MaxBytesReader header race in net/http

For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can...

EUVD-2026-123113

For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can...

GO-2026-6859 HTTP/1 server crash due to MaxBytesReader header race in net/http

For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can...

CVE-2026-97054: Go standard library net/http: For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without…

For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can...

PT-2026-144967

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description In HTTP/1 servers, a race condition occurs when the limit of MaxBytesReader is exceeded. The server automatically sets the "Connection: close" header without...

Elastic Beats packetbeat 8.0.x < 8.19.24 / 9.0.x < 9.4.9 / 9.5.x < 9.5.6 DoS (ESA-2026-208)

The version of Elastic Beats packetbeat installed on the remote host is 8.0.x prior to 8.19.24, 9.0.x prior to 9.4.9, or 9.5.x prior to 9.5.6. It is, therefore, affected by a denial of service vulnerability. - NULL Pointer Dereference CWE-476 in the AMQP protocol parser in Packetbeat can lead to ...

CVE-2026-115297

NULL Pointer Dereference CWE-476 in the AMQP protocol parser in Packetbeat can lead to denial of service via specially crafted network traffic. An unauthenticated attacker who can send traffic on a network segment that Packetbeat monitors for AMQP can cause a Go runtime panic that terminates the...

CVE-2026-115297

A NULL Pointer Dereference (CWE-476) vulnerability in the AMQP protocol parser of Packetbeat allows an unauthenticated attacker to cause a Go runtime panic , leading to a Denial of Service (DoS) . A single specially crafted packet sent on a monitored network segment is sufficient to terminate the...

EUVD-2026-116077

NULL Pointer Dereference CWE-476 in the AMQP protocol parser in Packetbeat can lead to denial of service via specially crafted network traffic. An unauthenticated attacker who can send traffic on a network segment that Packetbeat monitors for AMQP can cause a Go runtime panic that terminates the...

CVE-2026-115297 NULL Pointer Dereference in Packetbeat Leading to Denial of Service

NULL Pointer Dereference CWE-476 in the AMQP protocol parser in Packetbeat can lead to denial of service via specially crafted network traffic. An unauthenticated attacker who can send traffic on a network segment that Packetbeat monitors for AMQP can cause a Go runtime panic that terminates the...

CVE-2026-119143

A flaw was found in Wasmtime. Untrusted WebAssembly guest code can trigger a Denial of Service DoS by executing zero-length stream read or write operations with unvalidated memory addresses. This improper validation causes the host runtime to panic and unexpectedly terminate, crashing the host...

CVE-2026-115892

A flaw was found in Wasmtime. A malicious WebAssembly guest can cause a Denial of Service DoS by triggering an unhandled host runtime panic. When handling asynchronous streams or futures exchanged between the host and guest, Wasmtime fails to properly validate payload data types upon their return...

Security Bulletin: IBM CloudPak for Data Scheduling Service is vulnerable to CVE-2026-84303 and CVE-2026-84304

Summary gRPC-Go is used by the Scheduling Service. CVE-2026-84303 and CVE-2026-84304. Vulnerability Details CVEID:CVE-2026-84303 DESCRIPTION: gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase...

Security Bulletin: IBM CloudPak for Data Scheduling Service is vulnerable to CVE-2026-84304.

Summary gRPC-Go is used by the Scheduling Service. CVE-2026-84304. Vulnerability Details CVEID:CVE-2026-84304 DESCRIPTION: gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in...

GHSA-RJ39-CV6W-8WV7 kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path

Summary kin-openapi guards against NaN and Inf values in its built-in schema visitor visitJSON by returning ErrSchemaInputNaN / ErrSchemaInputInf when a float64 input violates those constraints. For OAS 3.1 specs, however, Schema.VisitJSON routes through useJSONSchema2020, which hands the value...

BIT-GITEA-2026-96399 Gitea denial of service through external issue tracker patterns

A repository's external issue tracker regular expression containing alternating capture groups could produce invalid slice indexes when Gitea rendered issue references, causing a runtime panic that terminated the Gitea process. A user who can edit a repository's external issue tracker settings...

Linux Distros Unpatched Vulnerability : CVE-2026-107325

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls...