Skip to content
fr Sign in
5.3 Medium

CVE-2025-58186 Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit

Description

Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as "a=;", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption.

Affected products and versions

Product Affected versions Fixed in
net/http 1.25 1.25.0 → < 1.25.2 1.25.2
net/http 1.24 earliest → < 1.24.8 1.24.8

References

Timeline

  1. Published
  2. Last modified

Other CVEs of net/http

The 26 CVEs of net/http →
CVE-2026-97032 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently 7.5 High CVE-2026-78663 The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream… 9.1 Critical CVE-2026-78669 A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams… 7.5 High CVE-2026-78667 When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS)… 7.5 High
Track this CVE