Excessive Cookie Parsing Vulnerability in Go HTTP Server
CVE-2025-58186
Currently unrated
What is CVE-2025-58186?
An issue exists in the Go HTTP server where the default 1MB limit on HTTP headers does not apply to the number of cookies that can be parsed. Attackers can exploit this by sending numerous small cookies, which can lead to significant memory consumption on the server. This could potentially degrade server performance or cause denial of service due to resource exhaustion.
Affected Version(s)
net/http 0 < 1.24.8
net/http 1.25.0 < 1.25.2