CVE-2017-1000098 Denial of service when parsing large forms in mime/multipart
HighCVSS 7.5
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "maxMemory" limit. It was possible for an attacker to generate a multipart request crafted such that the server ran out of file descriptors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| stdlib(Go) | < 1.6.4 | 1.6.4 |
| stdlib(Go) | >= 1.7.0-0, < 1.7.4 | 1.7.4 |
| golang go | < 1.6.4 | 1.6.4 |
| golang go | >= 1.7, < 1.7.4 | 1.7.4 |
References
- go.dev patch
- go.googlesource.com patch
- go.dev issue-tracking
- groups.google.com
- golang.org issue-tracking patch vendor-advisory
- golang.org issue-tracking patch vendor-advisory
- groups.google.com