When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade podman-testsUpgrade containers-commonUpgrade slirp4netnsUpgrade git-lfsUpgrade podman-remoteUpgrade golang-binUpgrade skopeo-testsUpgrade delveUpgrade oci-seccomp-bpf-hookUpgrade critUpgrade podman-gvproxyUpgrade go-toolsetUpgrade udicaUpgrade criu-libsUpgrade container-selinuxUpgrade runcUpgrade containernetworking-pluginsUpgrade crunUpgrade golang-docsUpgrade libslirp-develUpgrade podman-pluginsUpgrade python3-criuUpgrade criu-develUpgrade aardvark-dnsUpgrade golangUpgrade cockpit-podmanUpgrade buildah-testsUpgrade buildahUpgrade golang-testsUpgrade toolboxUpgrade podmanUpgrade golang-srcUpgrade criuUpgrade netavarkUpgrade podman-catatonitUpgrade python3-podmanUpgrade podman-dockerUpgrade skopeoUpgrade golang-miscUpgrade fuse-overlayfsUpgrade libslirpUpgrade toolbox-testsUpgrade conmonUpgrade gvisor-tap-vsock | May 8, 2024 | Mar 5, 2024 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Mar 5, 2024 |
| Amazon Linux Ami 2 | — | Upgrade golang-srcUpgrade golangUpgrade golang-testsUpgrade golang-miscUpgrade golang-docsUpgrade golang-binUpgrade golang-shared | May 31, 2024 | Mar 5, 2024 |
| Amazon_linux_2023 | — | Upgrade golang-sharedUpgrade golang-srcUpgrade golang-testsUpgrade golangUpgrade golang-binUpgrade golang-docsUpgrade golang-misc | Feb 17, 2025 | Mar 5, 2024 |
| Debian | — | No solution exists | May 15, 2025 | Mar 5, 2024 |
| Freebsd | — | Upgrade go121Upgrade go122 | Dec 10, 2025 | Mar 6, 2024 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Aug 8, 2024 | Mar 5, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | May 13, 2024 | Mar 5, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Jun 26, 2024 | Mar 5, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Jul 1, 2024 | Mar 5, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golangUpgrade golang-helpUpgrade golang-devel | Mar 18, 2025 | Mar 5, 2024 |
| Oracle_linux | — | Upgrade delveUpgrade libslirp-develUpgrade git-lfsUpgrade criu-develUpgrade runcUpgrade podman-remoteUpgrade skopeo-testsUpgrade python3-criuUpgrade criu-libsUpgrade udicaUpgrade crunUpgrade go-toolsetUpgrade podman-testsUpgrade critUpgrade oci-seccomp-bpf-hookUpgrade golang-docsUpgrade containers-commonUpgrade podman-pluginsUpgrade container-selinuxUpgrade skopeoUpgrade podman-dockerUpgrade containernetworking-pluginsUpgrade golang-srcUpgrade aardvark-dnsUpgrade podmanUpgrade slirp4netnsUpgrade cockpit-podmanUpgrade libslirpUpgrade podman-gvproxyUpgrade netavarkUpgrade buildahUpgrade golang-testsUpgrade golangUpgrade gvisor-tap-vsockUpgrade golang-binUpgrade criuUpgrade buildah-testsUpgrade golang-miscUpgrade conmonUpgrade fuse-overlayfsUpgrade python3-podmanUpgrade podman-catatonit | May 8, 2024 | Mar 5, 2024 |
| Redhat Openshift | — | Upgrade ose-gcp-gcr-image-credential-providerUpgrade ose-aws-ecr-image-credential-providerUpgrade butaneUpgrade golang-github-prometheus-promuUpgrade cri-toolsUpgrade openshiftUpgrade cri-oUpgrade ose-azure-acr-image-credential-providerUpgrade podman | Jun 28, 2024 | Mar 5, 2024 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | May 1, 2024 | Mar 5, 2024 |
| Rocky_linux | — | Upgrade fuse-overlayfs-debuginfoUpgrade toolbox-debugsourceUpgrade podman-debuginfoUpgrade critUpgrade fuse-overlayfsUpgrade criuUpgrade toolbox-testsUpgrade gvisor-tap-vsock-debugsourceUpgrade toolbox-debuginfoUpgrade gvisor-tap-vsock-debuginfoUpgrade libslirp-debuginfoUpgrade podmanUpgrade podman-remoteUpgrade netavarkUpgrade skopeoUpgrade podman-pluginsUpgrade podman-catatonitUpgrade buildahUpgrade delve-debugsourceUpgrade golang-binUpgrade criu-libs-debuginfoUpgrade containernetworking-pluginsUpgrade podman-remote-debuginfoUpgrade containers-commonUpgrade conmon-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade buildah-debuginfoUpgrade runcUpgrade podman-gvproxy-debuginfoUpgrade toolboxUpgrade criu-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade crun-debugsourceUpgrade podman-catatonit-debuginfoUpgrade git-lfs-debuginfoUpgrade buildah-debugsourceUpgrade libslirp-debugsourceUpgrade delve-debuginfoUpgrade runc-debuginfoUpgrade podman-gvproxyUpgrade git-lfs-debugsourceUpgrade buildah-testsUpgrade python3-criuUpgrade crun-debuginfoUpgrade conmonUpgrade criu-libsUpgrade golangUpgrade runc-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade buildah-tests-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade slirp4netns-debuginfoUpgrade slirp4netnsUpgrade podman-plugins-debuginfoUpgrade podman-testsUpgrade podman-debugsourceUpgrade aardvark-dnsUpgrade criu-develUpgrade crunUpgrade libslirp-develUpgrade criu-debuginfoUpgrade skopeo-testsUpgrade go-toolsetUpgrade containernetworking-plugins-debugsourceUpgrade conmon-debuginfoUpgrade delveUpgrade slirp4netns-debugsourceUpgrade gvisor-tap-vsockUpgrade git-lfsUpgrade oci-seccomp-bpf-hookUpgrade libslirp | May 13, 2024 | Mar 5, 2024 |
| Suse | — | Upgrade go1.22Upgrade go1.21-raceUpgrade go1.21-docUpgrade go1.22-raceUpgrade go1.21Upgrade go1.22-doc | Mar 8, 2024 | Mar 5, 2024 |
| Ubuntu | — | Upgrade golang-1.22-goUpgrade golang-1.22-srcUpgrade golang-1.18-src (Ubuntu Pro)Upgrade golang-1.22Upgrade golang-1.17Upgrade golang-1.18Upgrade golang-1.17-goUpgrade golang-1.18-go (Ubuntu Pro)Upgrade golang-1.18-goUpgrade golang-1.21-srcUpgrade golang-1.21Upgrade golang-1.21-goUpgrade golang-1.18 (Ubuntu Pro)Upgrade golang-1.18-srcUpgrade golang-1.17-src | Jul 10, 2024 | Mar 5, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 15, 2026 | Mar 5, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub