Excessive resource consumption in net/http, net/textproto and mime/multipart

CVE-2023-24536

What is CVE-2023-24536?

The multipart form parsing in Go's mime/multipart package can allow an attacker to exploit excessive CPU and memory consumption through malformed multipart forms. Specifically, the ReadForm method may inadvertently accept larger inputs than intended, causing significant resource strain. Factors contributing to this risk include inaccurate memory accounting, inadequate garbage collection handling for numerous small allocations, and the potential for the allocation of numerous short-lived buffers. Such conditions could lead to a denial of service in applications utilizing this functionality. Recent fixes improve memory consumption estimates and impose stricter limits on the number of parts and headers within multipart forms, enhancing stability and security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References