CVE-2023-45290
Memory exhaustion in multipart form parsing in net/textproto and net/http
- Published
- Updated
- Reserved
- Assigned by
- Go
Description
When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CISA-ADPADP (enrichment) | 3.1 | Medium6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| NVDNVD · Deferred | 3.1 | Medium6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 1.2% · top 32% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.
Weakness
- CWE-400: Uncontrolled Resource Consumption
- CWE-770 Allocation of Resources Without Limits or Throttling (opens in a new tab)All about CWE-770 and its CVEs
Affected products
Go standard library · net/textproto
- affected < 1.21.8
- affected 1.22.0-0 – < 1.22.1
References (6)
- https://go.dev/issue/65383 (opens in a new tab)x_transferred
- https://go.dev/cl/569341 (opens in a new tab)x_transferred
- https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg (opens in a new tab)x_transferred
- https://pkg.go.dev/vuln/GO-2024-2599 (opens in a new tab)x_transferred
- https://security.netapp.com/advisory/ntap-20240329-0004/ (opens in a new tab)x_transferred
- http://www.openwall.com/lists/oss-security/2024/03/08/4 (opens in a new tab)x_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2023-45290)Record last updated .