Excessive Memory Consumption in net/url Package in Go by Google

CVE-2025-61726

What is CVE-2025-61726?

The net/url package in Go lacks a limit on the number of query parameters that can be processed, which can lead to significant memory consumption when parsing large URL-encoded forms. Although the maximum request header size typically constrains the overall size of query parameters, the net/http.Request.ParseForm method can still handle forms with many unique parameters. This issue may result in performance degradation and resource exhaustion.

References