When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade skopeo-testsUpgrade oci-seccomp-bpf-hookUpgrade critUpgrade git-lfsUpgrade containernetworking-pluginsUpgrade golang-binUpgrade podman-pluginsUpgrade criu-libsUpgrade runcUpgrade python3-criuUpgrade delveUpgrade podman-gvproxyUpgrade crunUpgrade container-selinuxUpgrade golang-docsUpgrade podman-testsUpgrade go-toolsetUpgrade criu-develUpgrade containers-commonUpgrade podman-remoteUpgrade udicaUpgrade libslirp-develUpgrade slirp4netnsUpgrade conmonUpgrade python3-podmanUpgrade toolboxUpgrade libslirpUpgrade buildah-testsUpgrade toolbox-testsUpgrade netavarkUpgrade buildahUpgrade gvisor-tap-vsockUpgrade skopeoUpgrade podman-catatonitUpgrade podman-dockerUpgrade golang-srcUpgrade cockpit-podmanUpgrade podmanUpgrade aardvark-dnsUpgrade golang-testsUpgrade criuUpgrade fuse-overlayfsUpgrade golang-miscUpgrade golang | May 8, 2024 | Mar 5, 2024 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Mar 5, 2024 |
| Amazon Linux Ami 2 | — | Upgrade golang-binUpgrade golang-docsUpgrade golang-sharedUpgrade golangUpgrade golang-miscUpgrade golang-srcUpgrade golang-tests | May 31, 2024 | Mar 5, 2024 |
| Amazon_linux_2023 | — | Upgrade golang-srcUpgrade golang-docsUpgrade golang-binUpgrade golang-testsUpgrade golangUpgrade golang-miscUpgrade golang-shared | Feb 17, 2025 | Mar 5, 2024 |
| Debian | — | No solution exists | May 15, 2025 | Mar 5, 2024 |
| Freebsd | — | Upgrade go122Upgrade go121 | Dec 10, 2025 | Mar 6, 2024 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Aug 8, 2024 | Mar 5, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | May 13, 2024 | Mar 5, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Jun 26, 2024 | Mar 5, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade golangUpgrade golang-helpUpgrade golang-devel | Jul 1, 2024 | Mar 5, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golangUpgrade golang-helpUpgrade golang-devel | Mar 18, 2025 | Mar 5, 2024 |
| Oracle_linux | — | Upgrade podman-gvproxyUpgrade buildah-testsUpgrade criuUpgrade cockpit-podmanUpgrade golang-binUpgrade gvisor-tap-vsockUpgrade libslirpUpgrade slirp4netnsUpgrade skopeoUpgrade podmanUpgrade podman-catatonitUpgrade python3-podmanUpgrade golang-srcUpgrade containernetworking-pluginsUpgrade netavarkUpgrade podman-dockerUpgrade golang-miscUpgrade golang-testsUpgrade aardvark-dnsUpgrade buildahUpgrade fuse-overlayfsUpgrade golangUpgrade conmonUpgrade udicaUpgrade golang-docsUpgrade podman-remoteUpgrade skopeo-testsUpgrade criu-develUpgrade python3-criuUpgrade git-lfsUpgrade criu-libsUpgrade oci-seccomp-bpf-hookUpgrade critUpgrade go-toolsetUpgrade crunUpgrade podman-testsUpgrade container-selinuxUpgrade delveUpgrade containers-commonUpgrade podman-pluginsUpgrade libslirp-develUpgrade runc | May 8, 2024 | Mar 5, 2024 |
| Redhat Openshift | — | Upgrade openshiftUpgrade cri-oUpgrade butaneUpgrade golang-github-prometheus-promuUpgrade podmanUpgrade ose-azure-acr-image-credential-providerUpgrade cri-toolsUpgrade ose-aws-ecr-image-credential-providerUpgrade ose-gcp-gcr-image-credential-provider | Jun 28, 2024 | Mar 5, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernelUpgrade kernel-rt | May 1, 2024 | Mar 5, 2024 |
| Rocky_linux | — | Upgrade criu-libsUpgrade podman-debugsourceUpgrade podman-testsUpgrade slirp4netns-debuginfoUpgrade delve-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade golangUpgrade aardvark-dnsUpgrade python3-criuUpgrade slirp4netnsUpgrade buildah-tests-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade podman-gvproxyUpgrade slirp4netns-debugsourceUpgrade libslirp-debugsourceUpgrade conmon-debuginfoUpgrade libslirpUpgrade go-toolsetUpgrade git-lfsUpgrade criu-debuginfoUpgrade skopeo-testsUpgrade gvisor-tap-vsockUpgrade podman-plugins-debuginfoUpgrade runc-debuginfoUpgrade delveUpgrade git-lfs-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade buildah-testsUpgrade crunUpgrade conmonUpgrade containernetworking-plugins-debugsourceUpgrade crun-debuginfoUpgrade libslirp-develUpgrade criu-develUpgrade runc-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade podmanUpgrade toolbox-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade criuUpgrade gvisor-tap-vsock-debuginfoUpgrade toolbox-debugsourceUpgrade skopeoUpgrade podman-remoteUpgrade critUpgrade podman-debuginfoUpgrade fuse-overlayfsUpgrade golang-binUpgrade containernetworking-pluginsUpgrade criu-libs-debuginfoUpgrade containers-commonUpgrade delve-debugsourceUpgrade toolbox-testsUpgrade podman-remote-debuginfoUpgrade podman-pluginsUpgrade netavarkUpgrade libslirp-debuginfoUpgrade gvisor-tap-vsock-debugsourceUpgrade criu-debugsourceUpgrade buildah-debugsourceUpgrade buildahUpgrade podman-catatonitUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade git-lfs-debuginfoUpgrade conmon-debugsourceUpgrade buildah-debuginfoUpgrade toolboxUpgrade podman-catatonit-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade crun-debugsourceUpgrade runc | May 13, 2024 | Mar 5, 2024 |
| Suse | — | Upgrade go1.22-docUpgrade go1.21Upgrade go1.22-raceUpgrade go1.21-docUpgrade go1.22Upgrade go1.21-race | Mar 8, 2024 | Mar 5, 2024 |
| Ubuntu | — | Upgrade golang-1.17Upgrade golang-1.22-srcUpgrade golang-1.17-goUpgrade golang-1.22-goUpgrade golang-1.22Upgrade golang-1.18Upgrade golang-1.18-src (Ubuntu Pro)Upgrade golang-1.18-goUpgrade golang-1.18-go (Ubuntu Pro)Upgrade golang-1.17-srcUpgrade golang-1.18-srcUpgrade golang-1.21-goUpgrade golang-1.21Upgrade golang-1.21-srcUpgrade golang-1.18 (Ubuntu Pro) | Jul 10, 2024 | Mar 5, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 15, 2026 | Mar 5, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub