Memory exhaustion in query parameter parsing in net/url
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 1.9%
probabilidade de exploração
1.9%top 22% das CVEs
exploração observada
nãonenhuma fonte reporta
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
Go standard library · net/urlReferências
https://go.dev/cl/736712https://go.dev/issue/77101https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUchttps://pkg.go.dev/vuln/GO-2026-4341https://access.redhat.com/security/cve/CVE-2025-61726https://bugzilla.redhat.com/show_bug.cgi?id=2434432https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61726.jsonhttps://access.redhat.com/errata/RHSA-2026:3958https://access.redhat.com/errata/RHSA-2026:7676https://access.redhat.com/errata/RHSA-2026:4460https://access.redhat.com/errata/RHSA-2026:3959https://access.redhat.com/errata/RHSA-2026:6278