Excessive memory allocation in net/http and net/textproto

CVE-2023-24534

What is CVE-2023-24534?

This vulnerability arises from an improper handling of HTTP and MIME header parsing in certain versions of the Go programming language. Specifically, it can lead to excessive memory allocation even when processing small input requests. Attackers can exploit this flaw by sending specially crafted input, which forces the server to allocate more memory than is necessary. This behavior can culminate in memory exhaustion, ultimately resulting in a denial of service for legitimate users. Mitigation has been introduced to ensure that header parsing now accurately allocates only the memory required to handle the parsed headers.

References