Excessive resource consumption in mime/multipart

CVE-2022-41725

What is CVE-2022-41725?

A vulnerability in Go's net/http and mime/multipart packages allows for a denial of service due to excessive resource consumption. The multipart form parsing, specifically with functions like mime/multipart.Reader.ReadForm, can result in unbounded memory and disk usage, particularly when processing overly large or maliciously crafted forms. This is exacerbated by the unconfigurable 10MB reserved for non-file parts, leading to potential service disruption. While the updated ReadForm function now better manages memory allocation and limits the creation of temporary disk files, users must remain vigilant about the overall resource usage when handling multipart forms, as no inherent limit exists on disk consumption.

References