What’s Vulnerable › Vulnerabilities

CVE-2023-45290: Memory exhaustion in multipart form parsing in net/textproto and net/http

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-03-05 · updated 2026-06-17
• Weakness: CWE-770

Description

When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.

Affected products

• Go standard library net/textproto: before 1.21.8; from 1.22.0-0 before 1.22.1 — fixed in 1.21.8, 1.22.1

How to fix

Upgrade to a fixed version: Go standard library net/textproto 1.21.8, 1.22.1. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2024/03/08/4
• https://go.dev/cl/569341
• https://go.dev/issue/65383
• https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
• https://pkg.go.dev/vuln/GO-2024-2599
• https://security.netapp.com/advisory/ntap-20240329-0004/
• http://www.openwall.com/lists/oss-security/2024/03/08/4
• https://go.dev/cl/569341
• https://go.dev/issue/65383
• https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
• https://pkg.go.dev/vuln/GO-2024-2599
• https://security.netapp.com/advisory/ntap-20240329-0004/

Get alerted when CVE-2023-45290 or the next vulnerability affects your stack