What is GHSA-f4xw-m386-m277?

GHSA-f4xw-m386-m277 is a security advisory published by GitHub Security Advisories with High severity. When parsing a Range header containing a large number of small ranges, FileServer(FS),...

Which CVE IDs does GHSA-f4xw-m386-m277 cover?

GHSA-f4xw-m386-m277 covers the following CVE IDs: CVE-2026-78667. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-f4xw-m386-m277?

GHSA-f4xw-m386-m277 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-f4xw-m386-m277HighCVSS 7.5

When parsing a Range header containing a large number of small ranges, FileServer(FS),...

Vendor

GitHub Security Advisories

Published

October 9, 2026

Last Modified

October 9, 2026

🔗 CVE IDs covered (1)

CVE-2026-78667 →

📋 Description

When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2026-78667
https://go.dev/cl/847309
https://go.dev/issue/81858
https://groups.google.com/g/golang-announce/c/U2fTuyDJznI
https://pkg.go.dev/vuln/GO-2026-6609
https://github.com/advisories/GHSA-f4xw-m386-m277