6.5
Moyenne
CVE-2023-45290 When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue,…
Description
When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| net/textproto 1.22 | 1.22.0-0 → < 1.22.1 | 1.22.1 |
| net/textproto 1.21 | premières → < 1.21.8 | 1.21.8 |
Références
- go.dev go.dev
- go.dev go.dev
- groups.google.com groups.google.com
- pkg.go.dev pkg.go.dev
- security.netapp.com security.netapp.com
- www.openwall.com www.openwall.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de net/textproto
Les 6 CVE de net/textproto →
CVE-2026-94440
Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit…
7.5
Élevée
CVE-2026-42507
When returning errors, functions in the net/textproto package would include its input as part of the error
5.3
Moyenne
CVE-2025-61724
The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines
5.3
Moyenne
CVE-2023-24534
HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading…
7.5
Élevée