Description
The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "maxMemory" limit. It was possible for an attacker to generate a multipart request crafted such that the server ran out of file descriptors.
References (3)
Core 3
Core References
Mailing List x_refsource_confirm
https://groups.google.com/forum/#%21msg/golang-dev/4NdLzS8sls8/uIz8QlnIBQAJ
Issue Tracking, Patch, Vendor Advisory x_refsource_confirm
https://golang.org/issue/17965
Issue Tracking, Patch, Vendor Advisory x_refsource_confirm
https://golang.org/cl/30410
Scores
CVSS v3
7.5
EPSS
0.0043
EPSS Percentile
63.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Details
CWE
CWE-769
Status
published
Products (1)
golang/go
< 1.6.4
Published
Oct 05, 2017
Tracked Since
Feb 18, 2026