Is CVE-2026-97054 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-97054 being exploited in the wild.

How severe is CVE-2026-97054?

Informational severity, published 11 November 2026.

Which products and versions are affected?

stdlib (Go) SEMVER:introduced=0,fixed=1.26.11,introduced=1.27.0-0,fixed=1.27.4; Google Go .

Is there a fix for CVE-2026-97054?

Yes. stdlib (Go): upgrade to 1.27.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-97054 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-97054?

Check whether you run stdlib (Go) or Google Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-97054: Go HTTP/1 server race condition in MaxBytesReader header handling

CVE-2026-97054 · Severity: info · Published 2026-11-11

Go's HTTP/1 server framework automatically sets a "Connection: close" header when a request body exceeds size limits, but does so without synchronization. If a server handler concurrently reads the request body and writes response headers, a race condition can cause the server to crash with a runtime panic, resulting in denial of service.

Technologies: stdlib (Go), Google Go. Vendors: Go, Google.

Quick answers

Is CVE-2026-97054 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-97054 being exploited in the wild.
How severe is CVE-2026-97054?: Informational severity, published 11 November 2026.
Which products and versions are affected?: stdlib (Go) SEMVER:introduced=0,fixed=1.26.11,introduced=1.27.0-0,fixed=1.27.4; Google Go <UNKNOWN>.
Is there a fix for CVE-2026-97054?: Yes. stdlib (Go): upgrade to 1.27.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-97054 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-97054?: Check whether you run stdlib (Go) or Google Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

stdlib (Go): upgrade to 1.27.4 or later
```
go get stdlib@v1.27.4
```

Technical details

A race condition exists in Go's HTTP/1 server implementation when MaxBytesReader or MaxBytesHandler exceeds its limit: the framework sets the "Connection: close" header unsynchronized, racing with user code that sets headers in the handler. An attacker sends a request with a body larger than the configured limit while the handler concurrently writes response headers, triggering a panic that crashes the server process.

Affected products

Google Go <UNKNOWN>

Identifiers

CVE-2026-97054
GO-2026-6859

Timeline

2026-11-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.