CVE-2023-45290

Memory exhaustion in multipart form parsing in net/textproto and net/http

View on CVE.org
Published Mar 5, 2024 CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed
Description
When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2023-49589 When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.
Ubuntu USN Ubuntu USN USN-6886-1 Go vulnerabilities
Ubuntu USN Ubuntu USN USN-7109-1 Go vulnerabilities
Ubuntu USN Ubuntu USN USN-7111-1 Go vulnerabilities
History
Type Values Removed Values Added
First Time appeared Redhat ceph Storage
CPEs cpe:/a:redhat:ceph_storage:8.1::el9
Vendors & Products Redhat ceph Storage
Type Values Removed Values Added
First Time appeared Redhat openstack Podified
CPEs cpe:/a:redhat:openstack_podified:1.0::el9
Vendors & Products Redhat openstack Podified
Type Values Removed Values Added
Weaknesses CWE-770
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.17::el9
cpe:/a:redhat:run_once_duration_override_operator:1.2::el9
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.16::el9
Type Values Removed Values Added
First Time appeared Redhat openshift Builds
CPEs cpe:/a:redhat:openshift_builds:1.1::el9
Vendors & Products Redhat openshift Builds
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.12::el9
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.13::el8
cpe:/a:redhat:openshift:4.13::el9
cpe:/a:redhat:openshift:4.14::el8
cpe:/a:redhat:openshift:4.14::el9
cpe:/a:redhat:openshift:4.15::el8
cpe:/a:redhat:openshift:4.15::el9
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.12::el8
Type Values Removed Values Added
First Time appeared Redhat rhel Eus
CPEs cpe:/a:redhat:rhel_eus:8.8
cpe:/a:redhat:rhel_eus:9.2
Vendors & Products Redhat rhel Eus
Earlier changes (5)
Weaknesses

Sources

Status
PUBLISHED
Assigner
Go
Published
Updated
Feb 13, 2025, 5:14 PM
Reserved
Oct 6, 2023, 5:06 PM

View source JSON

Updated
Aug 2, 2024, 8:21 PM

JSON

Status
Deferred
Published
Mar 5, 2024, 11:15 PM
Modified
Jun 17, 2026, 6:28 AM

View source JSON

Severity
Moderate
Public date
Mar 5, 2024, 12:00 AM

View source Bugzilla JSON

No data.