CVE-2026-97054
CVE
High
Medium Impactnet/http: HTTP/1 Server Crash via MaxBytesReader Header Race
Exploitable under specific conditions
This vulnerability can affect KrakenD under specific conditions. Review the affected versions below and upgrade if your deployment is exposed.
Only KrakenD Enterprise is exposed, and only when you set
max_payload at the service
level (router namespace). KrakenD forwards the request body to the backend from the
HTTP client’s own goroutine, so a client that sends a body over the limit while KrakenD
is already writing the response, for instance because the backend answered or the
endpoint timed out before the whole body was forwarded, can crash the gateway. The
endpoint-level max_payload (proxy namespace) is not affected, and neither is the
Community Edition, which does not use MaxBytesReader. Until you upgrade, you can move
the body size limit to the load balancer or reverse proxy in front of KrakenD.Component
Go standard library (net/http)
Disclosed
Nov 12, 2026
Description
When a request body wrapped in
http.MaxBytesReader exceeds its limit, Go’s HTTP/1
server marks the connection for closing by setting a Connection: close response header
without any synchronization. If the handler reads the request body in one goroutine while
another one writes the response headers, the two writes race on the same header map and
the Go runtime aborts the whole process. An attacker who can send oversized bodies to an
affected server can crash it, a remote denial of service.Version summary
Community Edition
Not affected
Enterprise Edition
3.0.4, 2.13.14
addresses this advisory
Affected EE versions
>= 2.6, < 2.13.14 || >= 3.0, < 3.0.4
Upgrade to the addressed version or later to remediate this vulnerability.