Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as "a=;", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade go | Oct 31, 2025 | Oct 29, 2025 |
| Amazon Linux Ami 2 | — | Upgrade cri-tools-debuginfoUpgrade golang-sharedUpgrade cni-pluginsUpgrade oci-add-hooks-debuginfoUpgrade golist-debuginfoUpgrade amazon-ecr-credential-helper-debuginfoUpgrade cni-plugins-debuginfoUpgrade runfinch-finchUpgrade golangUpgrade cri-toolsUpgrade docker-debuginfoUpgrade amazon-cloudwatch-agentUpgrade amazon-ecr-credential-helperUpgrade amazon-ssm-agentUpgrade ecs-initUpgrade golistUpgrade rclone-debuginfoUpgrade dockerUpgrade containerd-debuginfoUpgrade runcUpgrade golang-binUpgrade oci-add-hooksUpgrade containerd-stressUpgrade containerdUpgrade golang-testsUpgrade nerdctlUpgrade runc-debuginfoUpgrade soci-snapshotterUpgrade golang-docsUpgrade rcloneUpgrade golang-miscUpgrade golang-srcUpgrade nerdctl-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade golang-srcUpgrade golang-miscUpgrade amazon-ssm-agentUpgrade golang-sharedUpgrade golangUpgrade golang-testsUpgrade golang-docsUpgrade golang-bin | Oct 31, 2025 | Oct 29, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Mar 17, 2026 | Mar 16, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade golangUpgrade golang-develUpgrade golang-help | Mar 10, 2026 | Mar 10, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Oct 29, 2025 |
| Splunk | — | Upgrade Splunk Enterprise to version 10.2.1Upgrade Splunk Enterprise to version 9.4.8Upgrade Splunk Enterprise to version 10.0.4Upgrade Splunk Enterprise to version 9.2.12Upgrade Splunk Enterprise to version 9.4.9Upgrade Splunk Enterprise to version 9.3.10Upgrade Splunk Enterprise to version 10.0.3Upgrade Splunk Enterprise to version 9.3.9 | Jul 30, 2026 | Oct 29, 2025 |
| Suse | — | Upgrade go1.24Upgrade go1.25-docUpgrade go1.24-raceUpgrade go1.24-docUpgrade go1.25Upgrade go1.25-race | Dec 5, 2025 | Oct 11, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Oct 29, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub