High · 7.5 CVE-2026-78667 BIT-golang-2026-78667EUVD-2026-95424GHSA-f4xw-m386-m277GO-2026-6609

Lack of limit on size of parsed Range headers in net/http

Published Oct 8, 2026 · Updated Oct 9, 2026 · Assigned by Go

Vendor: Go standard library Product: net/http Package: aactl Package: argo-cd-3.3 Package: argo-cd-3.3-compat Package: argo-cd-3.4 Package: argo-cd-3.4-compat Package: argo-workflow-executor-3.7 Package: argo-workflows-3.7 Package: argo-workflows-4.0 Package: atlantis Package: aws-otel-collector Package: calico-apiserver-3.31 Package: calico-apiserver-3.32 Package: cert-manager-1.20 Package: cert-manager-acmesolver-1.20 Package: cert-manager-controller-1.20 Package: cert-manager-startupapicheck-1.20 Package: cert-manager-webhook-1.20 Package: cert-manager-webhook-pdns Package: cfssl Package: chartmuseum Package: cilium-1.19 Package: cilium-1.19-clustermesh-apiserver Package: cilium-1.19-hubble-relay Package: cilium-1.19-operator-aws Package: cilium-1.19-operator-generic Package: cloudprober Package: cni-plugins-all Package: continuity Package: datadog-agent-7.77-full Package: datadog-agent-7.78-full Package: datadog-cluster-agent-7.77 Package: datadog-cluster-agent-7.78 Package: dogstatsd-7.77 Package: dogstatsd-7.78 Package: external-dns-0.21 Package: falco-no-driver Package: filebrowser Package: flux-2.7 Package: flux-2.8 Package: flux-source-controller Package: gcc Package: gitlab-pages-19.2 Package: gitlab-pages-19.3 Package: gitness Package: go Package: golang Package: golang-1.10 Package: golang-1.13 Package: golang-1.14 Package: golang-1.16 Package: golang-1.17 Package: golang-1.18 Package: golang-1.19 Package: golang-1.20 Package: golang-1.21 Package: golang-1.22 Package: golang-1.23 Package: golang-1.24 Package: golang-1.24 Package: golang-1.25 Package: golang-1.26 Package: golang-1.26 Package: golang-1.27 Package: golang-1.27 Package: golang-1.6 Package: golang-1.8 Package: golang-1.9 Package: gpu-feature-discovery Package: grafana-13.0 Package: grafana-agent-operator Package: grafana-alloy Package: grafana-mimir-3.1 Package: grafana-pyroscope-2.0 Package: harbor-2.14 Package: headlamp Package: hubble-ui-backend Package: ingress-nginx-controller-1.15 Package: ingress-nginx-custom-error-pages-1.15 Package: juicefs-1.3 Package: k3d Package: k6 Package: keda-2.19-metrics-apiserver Package: keda-2.20-metrics-apiserver Package: kube-apiserver-1.35 Package: kube-apiserver-1.36 Package: kube-arangodb-1.4 Package: kube-controller-manager-1.35 Package: kube-controller-manager-1.36 Package: kube-proxy-1.35 Package: kube-proxy-1.36 Package: kube-scheduler-1.35 Package: kube-scheduler-1.36 Package: kube-webhook-certgen-1.15 Package: kubeadm-1.35 Package: kubeadm-1.36 Package: kubectl-1.32 Package: kubectl-1.35 Package: kubectl-1.36 Package: kubelet-1.35 Package: kubelet-1.36 Package: kubernetes-1.35 Package: kubernetes-1.36 Package: kubevela-vela-cli Package: kyverno-policy-reporter Package: kyverno-policy-reporter-ui Package: linkerd2-tap Package: linkerd2-web Package: loki-3.6 Package: loki-3.6-logcli Package: loki-3.6-loki-canary Package: loki-3.6-promtail Package: mattermost-11.5 Package: mattermost-11.6 Package: mesosphere-vsphere-csi-driver Package: mesosphere-vsphere-csi-syncer Package: minio-operator Package: mps-control-daemon Package: nvidia-device-plugin Package: openbao Package: opencost Package: osv-scanner Package: prometheus-3.12 Package: prometheus-adapter Package: prometheus-alertmanager Package: promxy Package: python-tensorboard Package: rancher-2.13 Package: rancher-2.14 Package: rancher-agent-2.13 Package: rclone Package: renovate Package: rqlite Package: spire-agent Package: spire-oidc-discovery-provider Package: spire-server Package: stdlib Package: step Package: temporal-ui-server Package: tensorflow Package: terragrunt Package: vcluster Package: vcluster-syncer Package: victoriametrics Package: victoriametrics-vmagent Package: victoriametrics-vmalert Package: yunikorn-web Package: zarf Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.

Affected products

Vendor	Product	Affected	Fixed
Go standard library	net/http	< 1.26.9, 1.27.0-0 – < 1.27.2	1.26.9

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	golang-1.26	1.26.9-1	—
Debian 14	golang-1.27	1.27.2-1	—
Debian 13	golang-1.24	No fix yet	—
Debian 12	golang-1.19	No fix yet	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 26.10	golang-1.26 +1	No fix yet	—
Ubuntu 26.04 LTS	golang-1.23 +3	No fix yet	—
Ubuntu 24.04 LTS	golang-1.21 +4	No fix yet	—
Ubuntu 24.04 LTS	golang-1.22	1.22.2-2ubuntu0.5	USN-8935-1
Ubuntu 22.04 LTS	golang-1.17 +7	No fix yet	—
Ubuntu 22.04 LTS	golang-1.22	1.22.2-2~22.04.4	USN-8935-1
Ubuntu 20.04 LTS	golang-1.13 +4	No fix yet	—
Ubuntu 20.04 LTS	golang-1.22	1.22.2-2~20.04.3	USN-8935-1

Show 7 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu 18.04 LTS	golang-1.8 +2	No fix yet	—
Ubuntu 16.04 LTS	golang-1.6 +1	No fix yet	—
Ubuntu 14.04 LTS	golang-1.10	No fix yet	—
Ubuntu Pro 22.04 LTS	golang-1.13	No fix yet	—
Ubuntu Pro 20.04 LTS	golang-1.16	No fix yet	—
Ubuntu Pro 18.04 LTS	golang-1.13 +2	No fix yet	—
Ubuntu Pro 16.04 LTS	golang-1.13 +1	No fix yet	—

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 10	buildah +1	2:1.43.1-7.el10_2	ALSA-2026:88262
AlmaLinux 10	delve	1.26.1-3.el10_2	ALSA-2026:95519
AlmaLinux 10	golang +7	1.26.10-1.el10_2.alma.1	ALSA-2026:86093
AlmaLinux 10	ipp-usb	0.9.27-7.el10_2.4	ALSA-2026:88280
AlmaLinux 10	oci-seccomp-bpf-hook	1.2.11-3.el10_2	ALSA-2026:89752
AlmaLinux 10	opentelemetry-collector	0.158.0-2.el10_2	ALSA-2026:93596
AlmaLinux 10	podman +3	7:5.8.2-11.el10_2.alma.1	ALSA-2026:88336
AlmaLinux 10	skopeo +1	2:1.22.2-6.el10_2	ALSA-2026:89761
AlmaLinux 9	buildah +1	2:1.43.4-2.el9_8	ALSA-2026:90424
AlmaLinux 9	golang +7	1.26.10-1.el9_8	ALSA-2026:86196
AlmaLinux 9	grafana +1	10.2.6-23.el9_8.7	ALSA-2026:89744
AlmaLinux 9	opentelemetry-collector	0.158.0-2.el9_8	ALSA-2026:93617
AlmaLinux 9	podman +4	6:5.8.2-8.el9_8	ALSA-2026:90362
AlmaLinux 9	skopeo +1	2:1.22.2-9.el9_8	ALSA-2026:90462
AlmaLinux 8	aardvark-dns	2:1.10.1-2.module_el8.10.0+3901+4b80ecd7	ALSA-2026:89760
AlmaLinux 8	buildah +1	2:1.33.15-2.module_el8.10.0+4327+ab8e4068	ALSA-2026:89760
AlmaLinux 8	cockpit-podman	84.1-1.module_el8.10.0+4102+6c76e544	ALSA-2026:89760
AlmaLinux 8	conmon	3:2.1.10-2.module_el8.10.0+4327+ab8e4068	ALSA-2026:89760
AlmaLinux 8	container-selinux	2:2.229.0-3.module_el8.10.0+4213+0493256b	ALSA-2026:89760
AlmaLinux 8	containernetworking-plugins	1:1.4.0-11.module_el8.10.0+4327+ab8e4068	ALSA-2026:89760
AlmaLinux 8	containers-common	2:1-82.module_el8.10.0+3876+e55593a8	ALSA-2026:89760
AlmaLinux 8	crit +4	3.18-5.module_el8.10.0+3845+87b84552	ALSA-2026:89760
AlmaLinux 8	crun	1.14.3-4.module_el8.10.0+4269+94686149	ALSA-2026:89760
AlmaLinux 8	delve	1.26.1-1.module_el8.10.0+4307+6e4cbc60	ALSA-2026:86203
AlmaLinux 8	fuse-overlayfs	1.13-1.module_el8.10.0+3792+03eaed9c	ALSA-2026:89760
AlmaLinux 8	golang +7	1.26.10-1.module_el8.10.0+4307+6e4cbc60	ALSA-2026:86203
AlmaLinux 8	grafana +1	9.2.10-36.el8_10	ALSA-2026:88188
AlmaLinux 8	libslirp +1	4.4.0-2.module_el8.10.0+3845+87b84552	ALSA-2026:89760
AlmaLinux 8	netavark	2:1.10.3-1.module_el8.10.0+3845+87b84552	ALSA-2026:89760
AlmaLinux 8	oci-seccomp-bpf-hook	1.2.10-4.module_el8.10.0+4327+ab8e4068	ALSA-2026:89760
AlmaLinux 8	podman +6	4:4.9.4-38.module_el8.10.0+4327+ab8e4068	ALSA-2026:89760
AlmaLinux 8	python3-podman	4.9.0-3.module_el8.10.0+4016+efd18bf8	ALSA-2026:89760
AlmaLinux 8	runc	4:1.2.9-9.module_el8.10.0+4327+ab8e4068	ALSA-2026:89760
AlmaLinux 8	skopeo +1	2:1.14.6-5.module_el8.10.0+4327+ab8e4068	ALSA-2026:89760
AlmaLinux 8	slirp4netns	1.2.3-1.module_el8.10.0+3845+87b84552	ALSA-2026:89760
AlmaLinux 8	toolbox +1	0.0.99.5.1-1.module_el8.10.0+4120+03ad4b47	ALSA-2026:89760
AlmaLinux 8	udica	0.2.6-21.module_el8.10.0+4068+0e21408f	ALSA-2026:89760

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 10	buildah	2:1.43.1-7.el10_2	RLSA-2026:88262
Rocky Linux 10	delve	1.26.1-3.el10_2	RLSA-2026:98086, RLSA-2026:95519
Rocky Linux 10	golang	1.26.10-1.el10_2	RLSA-2026:86093
Rocky Linux 10	golang-github-openprinting-ipp-usb	0.9.27-7.el10_2.4	RLSA-2026:88280
Rocky Linux 10	gvisor-tap-vsock +1	6:0.8.7-2.el10_3	RLSA-2026:98610
Rocky Linux 10	oci-seccomp-bpf-hook	1.2.11-3.el10_2	RLSA-2026:98597, RLSA-2026:89752
Rocky Linux 10	opentelemetry-collector	0.158.0-2.el10_2	RLSA-2026:93596
Rocky Linux 10	podman	7:5.8.2-11.el10_2	RLSA-2026:88336
Rocky Linux 10	skopeo	2:1.22.2-6.el10_2	RLSA-2026:89761
Rocky Linux 9	buildah	2:1.43.4-2.el9_8	RLSA-2026:90424
Rocky Linux 9	golang	1.26.10-1.el9_8	RLSA-2026:86196
Rocky Linux 9	grafana	10.2.6-23.el9_8.7	RLSA-2026:89744
Rocky Linux 9	gvisor-tap-vsock +1	6:0.8.8-2.el9_9	RLSA-2026:98502
Rocky Linux 9	opentelemetry-collector	0.158.0-2.el9_8	RLSA-2026:93617
Rocky Linux 9	podman	6:5.8.2-8.el9_8	RLSA-2026:90362
Rocky Linux 9	skopeo	2:1.22.2-9.el9_8	RLSA-2026:90462
Rocky Linux 8	aardvark-dns	2:1.10.1-2.module+el8.10.0+1874+ce489889	RLSA-2026:89760
Rocky Linux 8	cockpit-podman	84.1-1.module+el8.10.0+1815+5fe7415e	RLSA-2026:89760
Rocky Linux 8	container-selinux	2:2.229.0-3.module+el8.10.0+40223+e940a224	RLSA-2026:89760
Rocky Linux 8	containers-common	2:1-82.module+el8.10.0+1843+6892ab28	RLSA-2026:89760
Rocky Linux 8	criu	3.18-5.module+el8.10.0+1815+5fe7415e	RLSA-2026:89760
Rocky Linux 8	crun	1.14.3-4.module+el8.10.0+40310+c25440c1	RLSA-2026:89760
Rocky Linux 8	delve	1.26.1-1.module+el8.10.0+40244+e7cb3ff8	RLSA-2026:86203
Rocky Linux 8	fuse-overlayfs	1.13-1.module+el8.10.0+1815+5fe7415e	RLSA-2026:89760
Rocky Linux 8	grafana	9.2.10-36.el8_10	RLSA-2026:88188
Rocky Linux 8	libslirp	4.4.0-2.module+el8.10.0+1815+5fe7415e	RLSA-2026:89760
Rocky Linux 8	netavark	2:1.10.3-1.module+el8.10.0+1815+5fe7415e	RLSA-2026:89760
Rocky Linux 8	python-podman	4.9.0-3.module+el8.10.0+1896+b18fa106	RLSA-2026:89760
Rocky Linux 8	slirp4netns	1.2.3-1.module+el8.10.0+1815+5fe7415e	RLSA-2026:89760
Rocky Linux 8	toolbox	0.0.99.5.1-1.module+el8.10.0+40087+cfe9c127.rocky.0.2	RLSA-2026:89760
Rocky Linux 8	udica	0.2.6-21.module+el8.10.0+1815+5fe7415e	RLSA-2026:89760

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP7	go1.26	1.26.9-150000.1.33.1	SUSE-SU-2026:4629-1
SLES 15 SP7	go1.26-openssl	1.26.10-150600.13.18.1	SUSE-SU-2026:4866-1
SLES 15 SP7	go1.27	1.27.2-150000.1.12.1	SUSE-SU-2026:4625-1
SLES 15 SP6	go1.26	1.26.9-150000.1.33.1	SUSE-SU-2026:4629-1
SLES 15 SP6	go1.26-openssl	1.26.10-150600.13.18.1	SUSE-SU-2026:4866-1
SLES 15 SP6	go1.27	1.27.2-150000.1.12.1	SUSE-SU-2026:4625-1
SLES 15 SP5	go1.26	1.26.9-150000.1.33.1	SUSE-SU-2026:4629-1
SLES 15 SP5	go1.26-openssl	1.26.10-150000.1.21.2	SUSE-SU-2026:4867-1
SLES 15 SP5	go1.27	1.27.2-150000.1.12.1	SUSE-SU-2026:4625-1
SLES 15 SP4	go1.26	1.26.9-150000.1.33.1	SUSE-SU-2026:4629-1
SLES 15 SP4	go1.26-openssl	1.26.10-150000.1.21.2	SUSE-SU-2026:4867-1
SLES 15 SP4	go1.27	1.27.2-150000.1.12.1	SUSE-SU-2026:4625-1

Show 7 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 16.0	go1.26	1.26.9-160000.1.1	SUSE-SU-2026:24239-1
SLES for SAP 16.0	go1.27	1.27.2-160000.1.1	SUSE-SU-2026:24237-1
SLES for SAP 15 SP6	go1.26	1.26.9-150000.1.33.1	SUSE-SU-2026:4629-1
SLES for SAP 15 SP6	go1.26-openssl	1.26.10-150600.13.18.1	SUSE-SU-2026:4866-1
SLES for SAP 15 SP6	go1.27	1.27.2-150000.1.12.1	SUSE-SU-2026:4625-1
SLES for SAP 15 SP5	go1.26	1.26.9-150000.1.33.1	SUSE-SU-2026:4629-1
SLES for SAP 15 SP5	go1.26-openssl	1.26.10-150000.1.21.2	SUSE-SU-2026:4867-1
SLES for SAP 15 SP5	go1.27	1.27.2-150000.1.12.1	SUSE-SU-2026:4625-1
SLES for SAP 15 SP4	go1.26	1.26.9-150000.1.33.1	SUSE-SU-2026:4629-1
SLES for SAP 15 SP4	go1.26-openssl	1.26.10-150000.1.21.2	SUSE-SU-2026:4867-1
SLES for SAP 15 SP4	go1.27	1.27.2-150000.1.12.1	SUSE-SU-2026:4625-1
SLES 16.0	go1.26	1.26.9-160000.1.1	SUSE-SU-2026:24239-1
SLES 16.0	go1.27	1.27.2-160000.1.1	SUSE-SU-2026:24237-1
SLE HPC 15 SP5	go1.26	1.26.9-150000.1.33.1	SUSE-SU-2026:4629-1
SLE HPC 15 SP5	go1.26-openssl	1.26.10-150000.1.21.2	SUSE-SU-2026:4867-1
SLE HPC 15 SP5	go1.27	1.27.2-150000.1.12.1	SUSE-SU-2026:4625-1
SLE HPC 15 SP4	go1.26	1.26.9-150000.1.33.1	SUSE-SU-2026:4629-1
SLE HPC 15 SP4	go1.26-openssl	1.26.10-150000.1.21.2	SUSE-SU-2026:4867-1
SLE HPC 15 SP4	go1.27	1.27.2-150000.1.12.1	SUSE-SU-2026:4625-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	go1.26	1.26.9-1.1	openSUSE-SU-2026:12093-1
openSUSE Tumbleweed	go1.27	1.27.2-1.1	openSUSE-SU-2026:12101-1
openSUSE Tumbleweed	rclone	1.75.2-1.1	openSUSE-SU-2026:12112-1
openSUSE Tumbleweed	tempo-cli	3.1.1-1.1	openSUSE-SU-2026:12351-1
openSUSE Leap 16.0	go1.26	1.26.9-160000.1.1	openSUSE-SU-2026:22095-1
openSUSE Leap 16.0	go1.27	1.27.2-160000.1.1	openSUSE-SU-2026:22093-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	go	1.26.9-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	amazon-ecr-credential-helper	0.12.0-5.amzn2023	ALAS2023-2026-3271
Amazon Linux 2023	buildah	2:1.43.1-1.amzn2023.0.2	ALAS2023-2026-3256
Amazon Linux 2023	cni-plugins	1.7.1-1.amzn2023.0.8	ALAS2023-2026-3258
Amazon Linux 2023	docker	25.0.18-1.amzn2023.0.1	ALAS2023-2026-3266
Amazon Linux 2023	git-lfs	3.7.1-82.amzn2023	ALAS2023-2026-3322
Amazon Linux 2023	golang +6	1.26.9-1.amzn2023.0.1	ALAS2023-2026-3225
Amazon Linux 2023	libcap +3	2.73-1.amzn2023.0.8	ALAS2023-2026-3255
Amazon Linux 2023	oci-add-hooks	0-0.1.20200504git268e3bb.amzn2023.0.13	ALAS2023-2026-3272
Amazon Linux 2023	skopeo +1	2:1.22.2-1.amzn2023.0.2	ALAS2023-2026-3254
Amazon Linux 2023	soci-snapshotter	0.16.0-1.amzn2023.0.2	ALAS2023-2026-3270
Amazon Linux 2023	yq	4.53.3-15.amzn2023	ALAS2023-2026-3257
Amazon Linux 2	cni-plugins	1.7.1-1.amzn2.0.8	ALAS2-2026-4017
Amazon Linux 2	cri-tools	1.32.0-1.amzn2.0.8	ALAS2-2026-4042
Amazon Linux 2	golang +6	1.26.9-1.amzn2.0.1	ALAS2-2026-4005

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 3	gcc +3	No fix yet	—

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 10	buildah +1	2:1.43.1-7.0.1.el10_2	ELSA-2026-88262
Oracle Linux 10	delve	1.26.1-3.0.1.el10_2	ELSA-2026-95519
Oracle Linux 10	golang +7	1.26.10-1.0.1.el10_2	ELSA-2026-86093
Oracle Linux 10	grafana +1	10.2.6-28.el10_2.9	ELSA-2026-89751
Oracle Linux 10	ipp-usb	0.9.27-7.el10_2.4	ELSA-2026-88280
Oracle Linux 10	oci-seccomp-bpf-hook	1.2.11-3.el10_2	ELSA-2026-89752
Oracle Linux 10	podman +3	7:5.8.2-11.0.1.el10_2	ELSA-2026-88336
Oracle Linux 10	skopeo +1	2:1.22.2-6.el10_2	ELSA-2026-89761
Oracle Linux 9	buildah +1	2:1.43.4-2.0.1.el9_8	ELSA-2026-90424
Oracle Linux 9	golang +7	1.26.10-1.0.1.el9_8	ELSA-2026-86196
Oracle Linux 9	grafana +1	10.2.6-23.el9_8.7	ELSA-2026-89744
Oracle Linux 9	podman +4	6:5.8.2-8.0.1.el9_8	ELSA-2026-90362
Oracle Linux 9	skopeo +1	2:1.22.2-9.el9_8	ELSA-2026-90462
Oracle Linux 8	aardvark-dns	2:1.10.1-2.module+el8.10.0+91087+698d4460	ELSA-2026-89760
Oracle Linux 8	buildah +1	2:1.33.15-2.module+el8.10.0+91087+698d4460	ELSA-2026-89760
Oracle Linux 8	cockpit-podman	84.1-1.module+el8.10.0+91087+698d4460	ELSA-2026-89760
Oracle Linux 8	conmon	3:2.1.10-2.module+el8.10.0+91087+698d4460	ELSA-2026-89760
Oracle Linux 8	container-selinux	2:2.229.0-3.module+el8.10.0+91087+698d4460	ELSA-2026-89760
Oracle Linux 8	containernetworking-plugins	1:1.4.0-11.module+el8.10.0+91087+698d4460	ELSA-2026-89760
Oracle Linux 8	containers-common	2:1-82.0.1.module+el8.10.0+91087+698d4460	ELSA-2026-89760
Oracle Linux 8	crit +4	3.18-5.module+el8.10.0+91087+698d4460	ELSA-2026-89760
Oracle Linux 8	crun	1.14.3-4.module+el8.10.0+91087+698d4460	ELSA-2026-89760
Oracle Linux 8	delve	1.26.1-1.0.1.module+el8.10.0+91008+b9491da4	ELSA-2026-86203
Oracle Linux 8	fuse-overlayfs	1.13-1.module+el8.10.0+91087+698d4460	ELSA-2026-89760
Oracle Linux 8	golang +7	1.26.10-1.0.1.module+el8.10.0+91075+4cd454b9	ELSA-2026-86203
Oracle Linux 8	grafana +1	9.2.10-36.0.1.el8_10	ELSA-2026-88188
Oracle Linux 8	libslirp +1	4.4.0-2.module+el8.10.0+91087+698d4460	ELSA-2026-89760
Oracle Linux 8	netavark	2:1.10.3-1.module+el8.10.0+91087+698d4460	ELSA-2026-89760
Oracle Linux 8	oci-seccomp-bpf-hook	1.2.10-4.module+el8.10.0+91087+698d4460	ELSA-2026-89760
Oracle Linux 8	podman +6	4:4.9.4-38.0.1.module+el8.10.0+91087+698d4460	ELSA-2026-89760
Oracle Linux 8	python3-podman	4.9.0-3.module+el8.10.0+91087+698d4460	ELSA-2026-89760
Oracle Linux 8	runc	4:1.2.9-9.module+el8.10.0+91087+698d4460	ELSA-2026-89760
Oracle Linux 8	skopeo +1	2:1.14.6-5.module+el8.10.0+91087+698d4460	ELSA-2026-89760
Oracle Linux 8	slirp4netns	1.2.3-1.module+el8.10.0+91087+698d4460	ELSA-2026-89760
Oracle Linux 8	udica	0.2.6-21.module+el8.10.0+91087+698d4460	ELSA-2026-89760

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	aactl	0.4.12-r79	—
Wolfi rolling	argo-cd-3.3 +1	3.3.15-r1	—
Wolfi rolling	argo-cd-3.4 +1	3.4.10-r1	—
Wolfi rolling	argo-workflows-3.7 +1	3.7.18-r10	—
Wolfi rolling	argo-workflows-4.0	4.0.12-r2	—
Wolfi rolling	atlantis	0.48.1-r1	—
Wolfi rolling	aws-otel-collector	0.50.0-r6	—
Wolfi rolling	calico-apiserver-3.31	3.31.7-r7	—
Wolfi rolling	calico-apiserver-3.32	3.32.3-r0	—
Wolfi rolling	cert-manager-1.20 +4	1.20.4-r2	—
Wolfi rolling	cert-manager-webhook-pdns	2.5.5-r27	—
Wolfi rolling	cfssl	1.7.1-r1	—
Wolfi rolling	chartmuseum	0.16.6-r9	—
Wolfi rolling	cilium-1.19 +4	1.19.8-r3	—
Wolfi rolling	cloudprober	0.14.6-r1	—
Wolfi rolling	cni-plugins-all	1.9.1-r16	—
Wolfi rolling	continuity	0.11.0-r5	—
Wolfi rolling	dogstatsd-7.78 +2	7.78.4-r23	—
Wolfi rolling	external-dns-0.21	0.21.0-r27	—
Wolfi rolling	falco-no-driver	0.45.0-r4	—
Wolfi rolling	filebrowser	2.63.23-r7	—
Wolfi rolling	flux-2.7	2.7.5-r41	—
Wolfi rolling	flux-2.8	2.8.8-r24	—
Wolfi rolling	flux-source-controller	1.9.6-r1	—
Wolfi rolling	gitlab-pages-19.2	19.2.7-r2	—
Wolfi rolling	gitlab-pages-19.3	19.3.3-r2	—
Wolfi rolling	gitness	3.3.0-r40	—
Wolfi rolling	grafana-13.0	13.0.10-r1	—
Wolfi rolling	grafana-alloy	1.20.1-r1	—
Wolfi rolling	grafana-mimir-3.1	3.1.7-r1	—
Wolfi rolling	grafana-pyroscope-2.0	2.0.6-r9	—
Wolfi rolling	harbor-2.14	2.14.4-r16	—
Wolfi rolling	headlamp	0.45.0-r9	—
Wolfi rolling	hubble-ui-backend	0.13.6-r1	—
Wolfi rolling	ingress-nginx-controller-1.15	1.15.10-r7	—
Wolfi rolling	juicefs-1.3	1.3.3-r10	—
Wolfi rolling	k3d	5.9.0-r14	—
Wolfi rolling	k6	2.3.0-r1	—
Wolfi rolling	keda-2.19-metrics-apiserver	2.19.0-r34	—
Wolfi rolling	keda-2.20-metrics-apiserver	2.20.2-r11	—
Wolfi rolling	kube-arangodb-1.4	1.4.5-r7	—
Wolfi rolling	kube-webhook-certgen-1.15 +1	1.15.10-r8	—
Wolfi rolling	kubeadm-1.35 +7	1.35.9-r1	—
Wolfi rolling	kubeadm-1.36 +7	1.36.5-r1	—
Wolfi rolling	kubectl-1.32 +4	No fix yet	—
Wolfi rolling	kubevela-vela-cli	1.11.0-r18	—
Wolfi rolling	kyverno-policy-reporter	3.11.0-r1	—
Wolfi rolling	kyverno-policy-reporter-ui	2.9.0-r1	—
Wolfi rolling	linkerd2-tap +1	26.10.1-r1	—
Wolfi rolling	loki-3.6 +3	3.6.17-r4	—
Wolfi rolling	mattermost-11.5	11.5.7-r14	—
Wolfi rolling	mattermost-11.6	11.6.6-r16	—
Wolfi rolling	mesosphere-vsphere-csi-driver +1	3.5.0-r33	—
Wolfi rolling	minio-operator	7.1.1-r34	—
Wolfi rolling	mps-control-daemon +2	0.20.1-r1	—
Wolfi rolling	openbao	2.7.1-r1	—
Wolfi rolling	opencost	1.121.3-r2	—
Wolfi rolling	osv-scanner	2.6.0-r1	—
Wolfi rolling	prometheus-3.12	3.12.0-r16	—
Wolfi rolling	prometheus-adapter	0.12.0-r39	—
Wolfi rolling	prometheus-alertmanager	0.34.1-r2	—
Wolfi rolling	promxy	0.0.97-r3	—
Wolfi rolling	rancher-2.13 +1	2.13.10-r3	—
Wolfi rolling	rancher-2.14	2.14.6-r3	—
Wolfi rolling	rclone	1.75.2-r0	—
Wolfi rolling	renovate	44.198.3-r1	—
Wolfi rolling	rqlite	10.5.3-r1	—
Wolfi rolling	spire-agent +2	1.15.3-r8	—
Wolfi rolling	step	0.31.0-r2	—
Wolfi rolling	temporal-ui-server	2.55.0-r1	—
Wolfi rolling	terragrunt	1.1.6-r1	—
Wolfi rolling	vcluster +1	0.37.3-r1	—
Wolfi rolling	victoriametrics +2	1.153.0-r1	—
Wolfi rolling	yunikorn-web	1.10.0-r1	—
Wolfi rolling	zarf	0.87.0-r1	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Go	stdlib	< 1.26.9 · >= 1.27.0-0, < 1.27.2	1.26.9, 1.27.2	GO-2026-6609

Advisories 50

RLSA-2026:98610 Important: gvisor-tap-vsock security update Rocky Linux Security Advisories · Nov 13, 2026
RLSA-2026:98597 Important: oci-seccomp-bpf-hook security update Rocky Linux Security Advisories · Nov 13, 2026
RLSA-2026:98502 Important: gvisor-tap-vsock security update Rocky Linux Security Advisories · Nov 13, 2026
RLSA-2026:98086 Important: delve security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 13, 2026
WID-SEC-2026-3841 Golang Go: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
ALAS2023-2026-3266 Important: docker security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 12, 2026
ALAS2023-2026-3254 Important: skopeo security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 11, 2026
ALAS2023-2026-3256 Important: buildah security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 11, 2026
RLSA-2026:95519 Important: delve security update Rocky Linux Security Advisories · Nov 6, 2026
ALSA-2026:95519 Important: delve security update AlmaLinux Security Advisories · Nov 6, 2026
ELSA-2026-95519 Important: delve security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Nov 5, 2026
ALSA-2026:93596 Important: opentelemetry-collector security update AlmaLinux Security Advisories · Nov 4, 2026
ALSA-2026:93617 Important: opentelemetry-collector security update AlmaLinux Security Advisories · Nov 4, 2026
RLSA-2026:93596 Important: opentelemetry-collector security update Rocky Linux Security Advisories · Nov 3, 2026
RLSA-2026:93617 Important: opentelemetry-collector security update Rocky Linux Security Advisories · Nov 3, 2026
ELSA-2026-89751 Important: grafana security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Nov 2, 2026
openSUSE-SU-2026:12351-1 tempo-cli-3.1.1-1.1 on GA media SUSE / openSUSE Security Updates · Oct 31, 2026
RLSA-2026:90362 Important: podman security update Rocky Linux Security Advisories · Oct 29, 2026
RLSA-2026:90424 Important: buildah security update Rocky Linux Security Advisories · Oct 29, 2026
RLSA-2026:90462 Important: skopeo security update Rocky Linux Security Advisories · Oct 29, 2026
ALSA-2026:86196 Important: golang security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:86093 Important: golang security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:90362 Important: podman security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:90424 Important: buildah security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:90462 Important: skopeo security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:89744 Critical: grafana security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:89752 Important: oci-seccomp-bpf-hook security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:89761 Important: skopeo security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:88336 Important: podman security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:88262 Important: buildah security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:88280 Important: golang-github-openprinting-ipp-usb security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:88188 Important: grafana security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:86203 Important: go-toolset:rhel8 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:89760 Important: container-tools:rhel8 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
RLSA-2026:89752 Important: oci-seccomp-bpf-hook security update Rocky Linux Security Advisories · Oct 27, 2026
RLSA-2026:89761 Important: skopeo security update Rocky Linux Security Advisories · Oct 27, 2026
RLSA-2026:89744 Critical: grafana security update Rocky Linux Security Advisories · Oct 27, 2026
ELSA-2026-90362 Important: podman security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 27, 2026
ELSA-2026-89760 Important: container-tools:ol8 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 27, 2026
ELSA-2026-90424 Important: buildah security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 27, 2026
RLSA-2026:89760 Important: container-tools:rhel8 security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 26, 2026
ALAS2023-2026-3270 Important: soci-snapshotter security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
ALAS2023-2026-3225 Important: golang security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
ALAS2023-2026-3271 Important: amazon-ecr-credential-helper security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
ALAS2023-2026-3272 Important: oci-add-hooks security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
ALAS2023-2026-3255 Important: libcap security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
ALAS2023-2026-3322 Important: git-lfs security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
ALAS2-2026-4005 Important: golang security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 26, 2026
ALAS2023-2026-3257 Important: yq security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
ALAS2-2026-4017 Important: cni-plugins security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 26, 2026

EUVD	v3.1	7.5
CISA-ADP	v3.1	7.5

Lack of limit on size of parsed Range headers in net/http

Description

Affected products

Fixed in Linux distributions

Debian

Ubuntu

AlmaLinux

Rocky Linux

SUSE

openSUSE

Alpine

Amazon Linux

Azure Linux

Oracle Linux

Wolfi

Affected packages

Advisories 50

References