Excessive resource consumption in net/http, net/textproto and mime/multipart

CVE-2023-24536

What is CVE-2023-24536?

The multipart form parsing in Go's mime/multipart package can allow an attacker to exploit excessive CPU and memory consumption through malformed multipart forms. Specifically, the ReadForm method may inadvertently accept larger inputs than intended, causing significant resource strain. Factors contributing to this risk include inaccurate memory accounting, inadequate garbage collection handling for numerous small allocations, and the potential for the allocation of numerous short-lived buffers. Such conditions could lead to a denial of service in applications utilizing this functionality. Recent fixes improve memory consumption estimates and impose stricter limits on the number of parts and headers within multipart forms, enhancing stability and security.

References