CVE-2023-24536: Excessive resource consumption in net/http, net/textproto and mime/multipart
Excessive resource consumption in net/http, net/textproto and mime/multipart
Other sources
Golang Go is vulnerable to a denial of service, caused by a flaw during multipart form parsing. By sending a specially crafted input, a remote attacker could exploit this vulnerability to consume large amounts of CPU and memory, and results in a denial of service condition.
— IBM
Multipart form parsing can consume large amounts of CPU and memory whe ...
— Debian
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/golang-1.19to a version that resolves this vulnerability.Fixed in 1.19.8-2 - Upgrade
Upgrade
redhat/golangto a version that resolves this vulnerability.Fixed in 1.20.3 - Upgrade
Upgrade
redhat/golangto a version that resolves this vulnerability.Fixed in 1.19.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.21.6-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.20.7-1 - Upgrade
Upgrade
golang/go/mime/multipart.Reader (ReadForm)to a version that resolves this vulnerability.Patch https://github.com/golang/go/issues/59153 - Upgrade
Upgrade
golang/go/mime/multipart.Reader (ReadForm)to a version that resolves this vulnerability.Patch https://github.com/golang/go/issues/59270 - Configuration
Limit multipart form parsing header-field count by setting environment variable GODEBUG=multipartmaxheaders= to enforce the vendor-stated maximum of 10,000 header fields for forms parsed with NextPart/NextRawPart.
Go mime/multipart.Reader (ReadForm / multipart form parsing) GODEBUG=multipartmaxheaders = Set/adjust to a value that limits the maximum number of header fields per form part (up to 10,000) - Configuration
Limit multipart form parsing part count by setting environment variable GODEBUG=multipartmaxparts= to enforce the vendor-stated maximum of 1000 parts for forms parsed with ReadForm.
Go net/http Request form parsing (ReadForm / ParseMultipartForm / PostFormValue / FormFile / FormValue) GODEBUG=multipartmaxparts = Set/adjust to a value that limits the maximum number of parts (up to 1000)
Event History
Frequently Asked Questions
What is CVE-2023-24536?
CVE-2023-24536 is a vulnerability that allows for consuming large amounts of CPU and memory during multipart form parsing.
What is the severity of CVE-2023-24536?
CVE-2023-24536 has a severity rating of 7.5 (High).
How does CVE-2023-24536 affect the affected software?
CVE-2023-24536 affects the affected software by causing excessive consumption of CPU and memory when processing multipart form inputs with a large number of parts.
How can I fix CVE-2023-24536?
To fix CVE-2023-24536, update the affected software to version 1.20.3 (for Red Hat's golang package) or version 1.19.8 (for Golang Go).
Where can I find more information about CVE-2023-24536?
You can find more information about CVE-2023-24536 at the following references: [Reference 1](https://go.dev/cl/482075), [Reference 2](https://go.dev/cl/482076), [Reference 3](https://go.dev/cl/482077).