CVE-2026-97054: 
Grafana vulnerability analysis and mitigation

CVE-2026-97054 is a race condition vulnerability in Go's net/http standard library package that can cause HTTP/1 servers to crash via a runtime panic. When MaxBytesReader's limit is exceeded, the server automatically sets a "Connection: close" header without proper synchronization, which can race with another header being set explicitly in the server handler. This affects Go net/http versions prior to 1.26.11 (1.26 branch) and versions 1.27.0-0 through 1.27.4 (1.27 branch). The vulnerability was published on November 11, 2026, with a patch advisory available via the GitHub Advisory Database (GHSA-rg98-f588-44xg). The CVSS base score is not formally assigned, but the vulnerability is estimated as Medium severity (GitHub Advisory, Go Vuln DB).

The root cause is a missing synchronization (CWE-820) when the MaxBytesReader or MaxBytesHandler limit is exceeded in Go's HTTP/1 server implementation. Upon limit exceedance, the server internally sets a "Connection: close" response header without holding the appropriate lock, creating a data race with any concurrent header write performed by the server handler goroutine. If a handler reads the request body concurrently with writing response headers — a common pattern — this unsynchronized access triggers a Go runtime panic, crashing the server process. The issue is tracked upstream at go.dev/issue/82563 and fixed via code change go.dev/cl/862185 (GitHub Advisory, Go Vuln DB).

Successful exploitation results in a Denial of Service (DoS) by crashing the Go HTTP/1 server process via a runtime panic. An unauthenticated remote attacker can trigger this condition by sending an oversized HTTP request body that exceeds the configured MaxBytesReader limit while the handler concurrently reads the body and writes response headers. There is no evidence of confidentiality or integrity impact; the vulnerability is limited to availability (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a specific concurrency pattern in the server handler (concurrent body read and response header write), which limits the attack surface to servers using MaxBytesReader or MaxBytesHandler with such handler designs (GitHub Advisory, Feedly).

1. Reconnaissance: Identify HTTP/1 servers built with Go's net/http package that use MaxBytesReader or MaxBytesHandler for request body size limiting, running Go versions prior to 1.26.11 or between 1.27.0 and 1.27.4.
2. Craft oversized request: Prepare an HTTP/1 POST (or similar) request with a body that exceeds the server's configured MaxBytesReader limit.
3. Trigger concurrent race: Send the oversized request to an endpoint whose handler concurrently reads the request body (e.g., in a goroutine) while also writing response headers. The timing must cause the internal unsynchronized "Connection: close" header set to race with the handler's explicit header write.
4. Induce runtime panic: The data race triggers a Go runtime panic, crashing the server process and causing a Denial of Service (GitHub Advisory, Go Issue).

• Logs: Go runtime panic stack traces in server logs referencing net/http header map concurrent write operations; log entries showing unexpected server process restarts or crashes.
• Process: Sudden termination of the Go HTTP server process with a non-zero exit code; process supervisor (e.g., systemd, Kubernetes) logs showing repeated restarts of the HTTP server service.
• Network: Repeated large HTTP/1 POST requests to the same endpoint exceeding the configured body size limit, particularly from a single source IP or a small set of IPs in a short time window.

Upgrade Go to version 1.26.11 or later (for the 1.26.x branch) or to version 1.27.4 or later (for the 1.27.x branch), which include the fix for the unsynchronized header write (GitHub Advisory, Go Vuln DB). As a workaround, review server handlers to avoid concurrent request body reading and response header writing patterns. Additionally, consider enforcing request body size limits at the network ingress layer (e.g., reverse proxy or load balancer) rather than relying solely on MaxBytesReader within the application handler.

The vulnerability was announced via the official golang-announce mailing list and disclosed on the oss-security mailing list. No significant independent researcher commentary or notable media coverage has been identified beyond standard vulnerability tracking and aggregation sites.