When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade podman-catatonitUpgrade toolboxUpgrade golangUpgrade python3-podmanUpgrade golang-miscUpgrade libslirpUpgrade golang-testsUpgrade fuse-overlayfsUpgrade podmanUpgrade toolbox-testsUpgrade podman-dockerUpgrade buildah-testsUpgrade conmonUpgrade buildahUpgrade netavarkUpgrade skopeoUpgrade gvisor-tap-vsockUpgrade golang-srcUpgrade aardvark-dnsUpgrade cockpit-podmanUpgrade criuUpgrade runcUpgrade slirp4netnsUpgrade container-selinuxUpgrade crunUpgrade udicaUpgrade podman-gvproxyUpgrade golang-docsUpgrade libslirp-develUpgrade criu-develUpgrade containers-commonUpgrade delveUpgrade containernetworking-pluginsUpgrade git-lfsUpgrade golang-binUpgrade skopeo-testsUpgrade podman-remoteUpgrade oci-seccomp-bpf-hookUpgrade podman-testsUpgrade python3-criuUpgrade go-toolsetUpgrade critUpgrade criu-libsUpgrade podman-plugins | May 8, 2024 | Mar 5, 2024 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Mar 5, 2024 |
| Amazon Linux Ami 2 | — | Upgrade golang-docsUpgrade golang-binUpgrade golang-sharedUpgrade golang-srcUpgrade golangUpgrade golang-miscUpgrade golang-tests | May 31, 2024 | Mar 5, 2024 |
| Amazon_linux_2023 | — | Upgrade golang-binUpgrade golang-srcUpgrade golang-miscUpgrade golangUpgrade golang-testsUpgrade golang-docsUpgrade golang-shared | Feb 17, 2025 | Mar 5, 2024 |
| Debian | — | No solution exists | May 15, 2025 | Mar 5, 2024 |
| Freebsd | — | Upgrade go122Upgrade go121 | Dec 10, 2025 | Mar 6, 2024 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Aug 8, 2024 | Mar 5, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-helpUpgrade golang-develUpgrade golang | May 13, 2024 | Mar 5, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golangUpgrade golang-helpUpgrade golang-devel | Jun 26, 2024 | Mar 5, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Jul 1, 2024 | Mar 5, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Mar 18, 2025 | Mar 5, 2024 |
| Oracle_linux | — | Upgrade podmanUpgrade aardvark-dnsUpgrade gvisor-tap-vsockUpgrade golang-srcUpgrade containernetworking-pluginsUpgrade buildahUpgrade golang-miscUpgrade podman-dockerUpgrade buildah-testsUpgrade criuUpgrade libslirpUpgrade golang-binUpgrade netavarkUpgrade slirp4netnsUpgrade cockpit-podmanUpgrade podman-gvproxyUpgrade skopeoUpgrade podman-catatonitUpgrade fuse-overlayfsUpgrade golang-testsUpgrade conmonUpgrade golangUpgrade python3-podmanUpgrade udicaUpgrade podman-testsUpgrade git-lfsUpgrade go-toolsetUpgrade crunUpgrade criu-libsUpgrade python3-criuUpgrade criu-develUpgrade container-selinuxUpgrade skopeo-testsUpgrade podman-remoteUpgrade libslirp-develUpgrade oci-seccomp-bpf-hookUpgrade critUpgrade runcUpgrade delveUpgrade golang-docsUpgrade podman-pluginsUpgrade containers-common | May 8, 2024 | Mar 5, 2024 |
| Redhat Openshift | — | Upgrade butaneUpgrade cri-toolsUpgrade podmanUpgrade openshiftUpgrade ose-azure-acr-image-credential-providerUpgrade cri-oUpgrade golang-github-prometheus-promuUpgrade ose-gcp-gcr-image-credential-providerUpgrade ose-aws-ecr-image-credential-provider | Jun 28, 2024 | Mar 5, 2024 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | May 1, 2024 | Mar 5, 2024 |
| Rocky_linux | — | Upgrade go-toolsetUpgrade containernetworking-plugins-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade runc-debugsourceUpgrade crunUpgrade runc-debuginfoUpgrade delve-debuginfoUpgrade podman-testsUpgrade podman-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade golangUpgrade criu-debuginfoUpgrade slirp4netns-debuginfoUpgrade podman-gvproxyUpgrade git-lfsUpgrade libslirpUpgrade gvisor-tap-vsockUpgrade criu-libsUpgrade delveUpgrade criu-develUpgrade libslirp-develUpgrade podman-plugins-debuginfoUpgrade python3-criuUpgrade buildah-tests-debuginfoUpgrade skopeo-testsUpgrade oci-seccomp-bpf-hookUpgrade aardvark-dnsUpgrade conmon-debuginfoUpgrade buildah-testsUpgrade conmonUpgrade slirp4netns-debugsourceUpgrade crun-debuginfoUpgrade slirp4netnsUpgrade git-lfs-debugsourceUpgrade libslirp-debugsourceUpgrade podman-remoteUpgrade critUpgrade netavarkUpgrade libslirp-debuginfoUpgrade containers-commonUpgrade podman-remote-debuginfoUpgrade criu-libs-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade crun-debugsourceUpgrade buildah-debuginfoUpgrade toolboxUpgrade runcUpgrade podman-gvproxy-debuginfoUpgrade podman-catatonit-debuginfoUpgrade toolbox-debuginfoUpgrade delve-debugsourceUpgrade toolbox-debugsourceUpgrade gvisor-tap-vsock-debuginfoUpgrade criuUpgrade fuse-overlayfs-debuginfoUpgrade podmanUpgrade buildah-debugsourceUpgrade podman-catatonitUpgrade criu-debugsourceUpgrade conmon-debugsourceUpgrade git-lfs-debuginfoUpgrade buildahUpgrade skopeoUpgrade podman-debuginfoUpgrade fuse-overlayfsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade golang-binUpgrade containernetworking-pluginsUpgrade gvisor-tap-vsock-debugsourceUpgrade toolbox-testsUpgrade podman-plugins | May 13, 2024 | Mar 5, 2024 |
| Suse | — | Upgrade go1.21-raceUpgrade go1.22Upgrade go1.21Upgrade go1.22-docUpgrade go1.21-docUpgrade go1.22-race | Mar 8, 2024 | Mar 5, 2024 |
| Ubuntu | — | Upgrade golang-1.18 (Ubuntu Pro)Upgrade golang-1.21-srcUpgrade golang-1.21-goUpgrade golang-1.21Upgrade golang-1.17-srcUpgrade golang-1.18-srcUpgrade golang-1.18-goUpgrade golang-1.18-go (Ubuntu Pro)Upgrade golang-1.22-srcUpgrade golang-1.22-goUpgrade golang-1.18Upgrade golang-1.18-src (Ubuntu Pro)Upgrade golang-1.17Upgrade golang-1.22Upgrade golang-1.17-go | Jul 10, 2024 | Mar 5, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 15, 2026 | Mar 5, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub