7.5
High
CVE-2025-61726 The net/url package does not set a limit on the number of query parameters in a query
Description
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| net/url 1.25 | 1.25.0 → < 1.25.6 | 1.25.6 |
| net/url 1.24 | earliest → < 1.24.12 | 1.24.12 |
| Red Hat Ansible Automation Platform 2.6 for RHEL 10 | Versions not published | |
| Red Hat Enterprise Linux Server (v. 7 ELS) | Versions not published | |
| Red Hat Ansible Automation Platform 2.4 for RHEL 8 | Versions not published | |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Versions not published | |
| Red Hat OpenShift Container Platform 4.12 1777001645 | earliest → < 1777001645 | 1777001645 |
| Red Hat OpenShift Container Platform 4.13 1779889628 | earliest → < 1779889628 | 1779889628 |
| Red Hat OpenShift Container Platform 4.16 1776729097 | earliest → < 1776729097 | 1776729097 |
Show the 231 other branches Hide the 231 other branches
References
- go.dev go.dev
- go.dev go.dev
- groups.google.com groups.google.com
- pkg.go.dev pkg.go.dev
Timeline
- Published
- Last modified
Other CVEs of net/url
The 5 CVEs of net/url →
CVE-2026-56860
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer…
5.9
Medium
CVE-2026-25679
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs
7.5
High
CVE-2025-47912
The Parse function permits values other than IPv6 addresses to be included in square brackets within the host…
5.3
Medium
CVE-2022-32190
JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path
Not rated