Memory exhaustion in query parameter parsing in net/url
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Go standard library | net/url | unaffected |
|
No data.
| Vendor | Product | Versions |
|---|---|---|
| Go Standard Library | Net/url | — |
No CVSS v4.0
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: 2.3% (2.292% probability within 30 days)
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Golang
Golang go |
|
| CPEs | cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Golang
Golang go |
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-770 | |
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Go Standard Library
Go Standard Library net/url |
|
| Vendors & Products |
Go Standard Library
Go Standard Library net/url |
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption. | |
| Title | Memory exhaustion in query parameter parsing in net/url | |
| References |
|
View source · Bugzilla · JSON
OpenCVE enrichment
Updated: Jan 29, 2026, 9:08 AM