CVE-2026-78667
EPSS 0.5%Recycled advisory notices only; no exploitation signal or independent verification.
What: Denial-of-service vulnerability in Go's FileServer, ServeContent, and ServeFile functions when parsing Range headers with many small ranges, causing excessive CPU consumption. CVSS and EPSS both minimal (0.00379 pct).
Why it matters: Not KEV-listed; extremely low EPSS score (0.30734th percentile) suggests minimal real-world exploitation risk. Chatter is entirely vendor patching notices across Google Apigee components—no PoC, no active exploitation reports, no defender triage signals.
Where it's seen: Bulk security advisory posts on Bluesky listing CVE-2026-78667 alongside dozens of other CVEs in Apigee modules (watcher, udca, redis, prometheus, cassandra, istiod). Pure vendor release noise; no independent analysis or threat hunting.
RISK: LOW — DoS vector with negligible EPSS; no in-the-wild evidence; vendor-patched.
Description
When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.