CVE-2017-1000098

The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "maxMemory" limit. It was possible for an attacker to generate a multipart request crafted such that the server ran out of file descriptors.

Score

CVSS 3.1 7.5 High

Status

Modified - cve@mitre.org

Published

2017-10-05

Last modified

2024-09-16

Weaknesses

CWE-769

Affected products

• Go (Golang)

References

• https://golang.org/cl/30410
• https://golang.org/issue/17965
• https://groups.google.com/forum/#%21msg/golang-dev/4NdLzS8sls8/uIz8QlnIBQAJ