When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade delveUpgrade python3-criuUpgrade git-lfsUpgrade go-toolsetUpgrade podman-remoteUpgrade skopeo-testsUpgrade golang-binUpgrade containernetworking-pluginsUpgrade golang-docsUpgrade runcUpgrade podman-pluginsUpgrade crunUpgrade criu-develUpgrade critUpgrade libslirp-develUpgrade podman-gvproxyUpgrade container-selinuxUpgrade udicaUpgrade oci-seccomp-bpf-hookUpgrade containers-commonUpgrade slirp4netnsUpgrade podman-testsUpgrade criu-libsUpgrade cockpit-podmanUpgrade aardvark-dnsUpgrade golang-srcUpgrade criuUpgrade podmanUpgrade conmonUpgrade golangUpgrade buildah-testsUpgrade skopeoUpgrade toolboxUpgrade toolbox-testsUpgrade libslirpUpgrade golang-miscUpgrade podman-dockerUpgrade buildahUpgrade netavarkUpgrade python3-podmanUpgrade gvisor-tap-vsockUpgrade fuse-overlayfsUpgrade podman-catatonitUpgrade golang-tests | May 8, 2024 | Mar 5, 2024 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Mar 5, 2024 |
| Amazon Linux Ami 2 | — | Upgrade golang-binUpgrade golang-sharedUpgrade golang-docsUpgrade golang-miscUpgrade golang-srcUpgrade golangUpgrade golang-tests | May 31, 2024 | Mar 5, 2024 |
| Amazon_linux_2023 | — | Upgrade golang-sharedUpgrade golang-docsUpgrade golang-miscUpgrade golang-srcUpgrade golangUpgrade golang-binUpgrade golang-tests | Feb 17, 2025 | Mar 5, 2024 |
| Debian | — | No solution exists | May 15, 2025 | Mar 5, 2024 |
| Freebsd | — | Upgrade go122Upgrade go121 | Dec 10, 2025 | Mar 6, 2024 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Aug 8, 2024 | Mar 5, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | May 13, 2024 | Mar 5, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Jun 26, 2024 | Mar 5, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Jul 1, 2024 | Mar 5, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Mar 18, 2025 | Mar 5, 2024 |
| Oracle_linux | — | Upgrade container-selinuxUpgrade podman-pluginsUpgrade delveUpgrade libslirp-develUpgrade podman-remoteUpgrade skopeo-testsUpgrade runcUpgrade criu-libsUpgrade oci-seccomp-bpf-hookUpgrade golang-docsUpgrade critUpgrade containers-commonUpgrade criu-develUpgrade crunUpgrade python3-criuUpgrade go-toolsetUpgrade podman-testsUpgrade udicaUpgrade git-lfsUpgrade buildah-testsUpgrade buildahUpgrade python3-podmanUpgrade golangUpgrade golang-binUpgrade netavarkUpgrade golang-miscUpgrade fuse-overlayfsUpgrade gvisor-tap-vsockUpgrade podman-gvproxyUpgrade golang-testsUpgrade podman-dockerUpgrade golang-srcUpgrade containernetworking-pluginsUpgrade aardvark-dnsUpgrade cockpit-podmanUpgrade slirp4netnsUpgrade libslirpUpgrade podmanUpgrade podman-catatonitUpgrade skopeoUpgrade conmonUpgrade criu | May 8, 2024 | Mar 5, 2024 |
| Redhat Openshift | — | Upgrade ose-aws-ecr-image-credential-providerUpgrade ose-gcp-gcr-image-credential-providerUpgrade cri-oUpgrade openshiftUpgrade podmanUpgrade cri-toolsUpgrade golang-github-prometheus-promuUpgrade ose-azure-acr-image-credential-providerUpgrade butane | Jun 28, 2024 | Mar 5, 2024 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | May 1, 2024 | Mar 5, 2024 |
| Rocky_linux | — | Upgrade toolboxUpgrade toolbox-debugsourceUpgrade criu-debugsourceUpgrade podman-catatonitUpgrade buildah-debuginfoUpgrade git-lfs-debuginfoUpgrade podman-remote-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade crun-debugsourceUpgrade gvisor-tap-vsock-debugsourceUpgrade netavarkUpgrade buildah-debugsourceUpgrade runcUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-catatonit-debuginfoUpgrade conmon-debugsourceUpgrade buildahUpgrade toolbox-debuginfoUpgrade podmanUpgrade podman-remoteUpgrade podman-debuginfoUpgrade toolbox-testsUpgrade fuse-overlayfsUpgrade podman-pluginsUpgrade containers-commonUpgrade criu-libs-debuginfoUpgrade critUpgrade criuUpgrade podman-gvproxy-debuginfoUpgrade libslirp-debuginfoUpgrade skopeoUpgrade fuse-overlayfs-debuginfoUpgrade gvisor-tap-vsock-debuginfoUpgrade golang-binUpgrade containernetworking-pluginsUpgrade delve-debugsourceUpgrade slirp4netnsUpgrade slirp4netns-debugsourceUpgrade crun-debuginfoUpgrade python3-criuUpgrade podman-plugins-debuginfoUpgrade git-lfs-debugsourceUpgrade libslirp-debugsourceUpgrade runc-debuginfoUpgrade podman-testsUpgrade slirp4netns-debuginfoUpgrade buildah-testsUpgrade delve-debuginfoUpgrade buildah-tests-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade runc-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade libslirpUpgrade podman-gvproxyUpgrade gvisor-tap-vsockUpgrade git-lfsUpgrade podman-debugsourceUpgrade criu-libsUpgrade conmonUpgrade libslirp-develUpgrade criu-develUpgrade crunUpgrade aardvark-dnsUpgrade go-toolsetUpgrade delveUpgrade criu-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade conmon-debuginfoUpgrade skopeo-testsUpgrade fuse-overlayfs-debugsourceUpgrade golang | May 13, 2024 | Mar 5, 2024 |
| Suse | — | Upgrade go1.22Upgrade go1.21-raceUpgrade go1.21-docUpgrade go1.22-raceUpgrade go1.22-docUpgrade go1.21 | Mar 8, 2024 | Mar 5, 2024 |
| Ubuntu | — | Upgrade golang-1.17Upgrade golang-1.17-goUpgrade golang-1.22Upgrade golang-1.18Upgrade golang-1.22-srcUpgrade golang-1.18-src (Ubuntu Pro)Upgrade golang-1.22-goUpgrade golang-1.18 (Ubuntu Pro)Upgrade golang-1.18-goUpgrade golang-1.18-go (Ubuntu Pro)Upgrade golang-1.17-srcUpgrade golang-1.18-srcUpgrade golang-1.21Upgrade golang-1.21-srcUpgrade golang-1.21-go | Jul 10, 2024 | Mar 5, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 15, 2026 | Mar 5, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub