Excessive resource consumption in mime/multipart

CVE-2022-41725

What is CVE-2022-41725?

A vulnerability in Go's net/http and mime/multipart packages allows for a denial of service due to excessive resource consumption. The multipart form parsing, specifically with functions like mime/multipart.Reader.ReadForm, can result in unbounded memory and disk usage, particularly when processing overly large or maliciously crafted forms. This is exacerbated by the unconfigurable 10MB reserved for non-file parts, leading to potential service disruption. While the updated ReadForm function now better manages memory allocation and limits the creation of temporary disk files, users must remain vigilant about the overall resource usage when handling multipart forms, as no inherent limit exists on disk consumption.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References