When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade podman-testsUpgrade podman-pluginsUpgrade go-toolsetUpgrade golang-binUpgrade podman-remoteUpgrade criu-develUpgrade runcUpgrade container-selinuxUpgrade criu-libsUpgrade containernetworking-pluginsUpgrade crunUpgrade delveUpgrade containers-commonUpgrade skopeo-testsUpgrade critUpgrade slirp4netnsUpgrade libslirp-develUpgrade oci-seccomp-bpf-hookUpgrade podman-gvproxyUpgrade golang-docsUpgrade python3-criuUpgrade udicaUpgrade git-lfsUpgrade golang-srcUpgrade golang-testsUpgrade podman-catatonitUpgrade podmanUpgrade criuUpgrade cockpit-podmanUpgrade skopeoUpgrade aardvark-dnsUpgrade golang-miscUpgrade toolbox-testsUpgrade podman-dockerUpgrade libslirpUpgrade buildah-testsUpgrade toolboxUpgrade conmonUpgrade netavarkUpgrade buildahUpgrade fuse-overlayfsUpgrade gvisor-tap-vsockUpgrade python3-podmanUpgrade golang | May 8, 2024 | Mar 5, 2024 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Mar 5, 2024 |
| Amazon Linux Ami 2 | — | Upgrade golang-testsUpgrade golangUpgrade golang-srcUpgrade golang-miscUpgrade golang-docsUpgrade golang-binUpgrade golang-shared | May 31, 2024 | Mar 5, 2024 |
| Amazon_linux_2023 | — | Upgrade golang-sharedUpgrade golang-miscUpgrade golangUpgrade golang-srcUpgrade golang-testsUpgrade golang-docsUpgrade golang-bin | Feb 17, 2025 | Mar 5, 2024 |
| Debian | — | No solution exists | May 15, 2025 | Mar 5, 2024 |
| Freebsd | — | Upgrade go122Upgrade go121 | Dec 10, 2025 | Mar 6, 2024 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Aug 8, 2024 | Mar 5, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golangUpgrade golang-develUpgrade golang-help | May 13, 2024 | Mar 5, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Jun 26, 2024 | Mar 5, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Jul 1, 2024 | Mar 5, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Mar 18, 2025 | Mar 5, 2024 |
| Oracle_linux | — | Upgrade podman-pluginsUpgrade criu-develUpgrade golang-docsUpgrade python3-criuUpgrade containers-commonUpgrade criu-libsUpgrade git-lfsUpgrade oci-seccomp-bpf-hookUpgrade critUpgrade podman-remoteUpgrade runcUpgrade skopeo-testsUpgrade container-selinuxUpgrade udicaUpgrade crunUpgrade go-toolsetUpgrade podman-testsUpgrade libslirp-develUpgrade delveUpgrade golangUpgrade netavarkUpgrade gvisor-tap-vsockUpgrade containernetworking-pluginsUpgrade libslirpUpgrade slirp4netnsUpgrade golang-miscUpgrade fuse-overlayfsUpgrade conmonUpgrade podman-dockerUpgrade cockpit-podmanUpgrade buildahUpgrade skopeoUpgrade podman-catatonitUpgrade podman-gvproxyUpgrade python3-podmanUpgrade podmanUpgrade golang-srcUpgrade golang-testsUpgrade criuUpgrade buildah-testsUpgrade golang-binUpgrade aardvark-dns | May 8, 2024 | Mar 5, 2024 |
| Redhat Openshift | — | Upgrade cri-oUpgrade butaneUpgrade ose-azure-acr-image-credential-providerUpgrade cri-toolsUpgrade golang-github-prometheus-promuUpgrade openshiftUpgrade podmanUpgrade ose-gcp-gcr-image-credential-providerUpgrade ose-aws-ecr-image-credential-provider | Jun 28, 2024 | Mar 5, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernelUpgrade kernel-rt | May 1, 2024 | Mar 5, 2024 |
| Rocky_linux | — | Upgrade podman-catatonit-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade runcUpgrade buildah-debuginfoUpgrade crun-debugsourceUpgrade podman-remote-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-catatonitUpgrade toolboxUpgrade libslirp-debuginfoUpgrade netavarkUpgrade podman-pluginsUpgrade skopeoUpgrade containernetworking-pluginsUpgrade podman-remoteUpgrade delve-debugsourceUpgrade criu-debugsourceUpgrade podmanUpgrade git-lfs-debuginfoUpgrade buildahUpgrade critUpgrade fuse-overlayfsUpgrade podman-debuginfoUpgrade gvisor-tap-vsock-debuginfoUpgrade toolbox-debugsourceUpgrade criuUpgrade criu-libs-debuginfoUpgrade buildah-debugsourceUpgrade containers-commonUpgrade conmon-debugsourceUpgrade toolbox-testsUpgrade gvisor-tap-vsock-debugsourceUpgrade golang-binUpgrade toolbox-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade crunUpgrade slirp4netns-debugsourceUpgrade gvisor-tap-vsockUpgrade oci-seccomp-bpf-hookUpgrade libslirpUpgrade criu-develUpgrade buildah-tests-debuginfoUpgrade runc-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade criu-libsUpgrade golangUpgrade containernetworking-plugins-debuginfoUpgrade delveUpgrade criu-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade conmon-debuginfoUpgrade skopeo-testsUpgrade go-toolsetUpgrade slirp4netns-debuginfoUpgrade runc-debuginfoUpgrade podman-testsUpgrade podman-debugsourceUpgrade delve-debuginfoUpgrade libslirp-debugsourceUpgrade buildah-testsUpgrade git-lfs-debugsourceUpgrade crun-debuginfoUpgrade conmonUpgrade python3-criuUpgrade podman-plugins-debuginfoUpgrade slirp4netnsUpgrade git-lfsUpgrade podman-gvproxyUpgrade aardvark-dnsUpgrade libslirp-devel | May 13, 2024 | Mar 5, 2024 |
| Suse | — | Upgrade go1.21-raceUpgrade go1.22Upgrade go1.21Upgrade go1.21-docUpgrade go1.22-raceUpgrade go1.22-doc | Mar 8, 2024 | Mar 5, 2024 |
| Ubuntu | — | Upgrade golang-1.18Upgrade golang-1.18-src (Ubuntu Pro)Upgrade golang-1.22-goUpgrade golang-1.22-srcUpgrade golang-1.22Upgrade golang-1.17-goUpgrade golang-1.17Upgrade golang-1.21-goUpgrade golang-1.21-srcUpgrade golang-1.18 (Ubuntu Pro)Upgrade golang-1.17-srcUpgrade golang-1.18-goUpgrade golang-1.18-go (Ubuntu Pro)Upgrade golang-1.18-srcUpgrade golang-1.21 | Jul 10, 2024 | Mar 5, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 15, 2026 | Mar 5, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub