The vulnerability lies in the Go standard library’s net/http package’s handling of the HTTP Range header. The unbounded parsing logic is a CWE‑770 weakness, meaning unbounded resource consumption. When a request contains a large number of small ranges, the server parses them all, consuming excessive CPU time. Because there is no limit on the number of ranges, an attacker can craft a request that forces the server to perform a huge amount of work, potentially exhausting CPU cycles and causing a denial of service, without granting code execution or data disclosure.

All applications built with the Go standard library that use FileServer, ServeContent or ServeFile functions are affected. Any server or service that accepts Range headers via net/http is vulnerable, regardless of the Go release version; version information is not provided, so administrators should assume all releases may be vulnerable until a patch that adds the unbounded parsing limits is applied.

The CVSS score is 7.5, indicating a high severity. The Exploit Prediction Scoring System value is not available. The vulnerability is not listed in CISA’s KEV catalogue. Based on the description, it is inferred that attackers can exploit it remotely by sending HTTP requests with a Range header containing a large number of small ranges, which forces the server to iterate over each range, increasing CPU usage. Because the flaw lies only in input parsing, the attack is straightforward and requires no privileged access, presenting a moderate risk without mitigation.