CVE-2017-1000098: Denial of Service in Go stdlib/mime/multipart
Summary
CVE-2017-1000098: Denial of service when parsing large forms in mime/multipart. Affects stdlib across 2 version ranges.
< 1.6.4
>= 1.7.0-0, < 1.7.4
Fixed in 1.6.4 or 1.7.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Go standard library (stdlib) is a collection of packages that provide fundamental functionality for Go programs. The 'mime/multipart' package in the stdlib is responsible for parsing and generating MIME multipart messages. It allows developers to handle form data and file uploads in HTTP requests. However, a vulnerability exists in the package that can be exploited to cause a denial-of-service (DoS) attack. By sending large multipart/form-data, an attacker can force the HTTP server to open a significant number of file descriptors, leading to resource exhaustion and rendering the server unresponsive.
Vulnerability Detail
The vulnerability (CVE-2017-1000098) in the 'mime/multipart' package arises when parsing large multipart/form-data. An attacker can exploit this vulnerability to overwhelm the HTTP server with a high number of file descriptors, causing a denial-of-service condition. This can result in the server becoming unresponsive and unable to handle legitimate requests. The impact of this vulnerability can be severe, as it can disrupt the availability of the affected server and potentially impact the overall system's performance.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.6.41.6.4go get stdlib@v1.6.4 -
>= 1.7.0-0, < 1.7.41.7.4go get stdlib@v1.7.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, developers can implement rate limiting or request size limits on the server-side to mitigate the impact of potential DoS attacks. By limiting the number of simultaneous requests or the size of multipart/form-data that can be processed, the server can reduce the risk of resource exhaustion. However, it is important to note that workarounds may only mitigate the issue to some extent and may not provide complete protection against sophisticated attacks. Therefore, updating to a fixed version of the Go stdlib package is still the recommended solution.
Conclusion
In conclusion, the 'mime/multipart' package in the Go stdlib is vulnerable to a denial-of-service attack when parsing large forms. This can lead to resource exhaustion and render the affected server unresponsive. To mitigate this vulnerability, it is crucial to update the Go stdlib package to a fixed version. Additionally, implementing rate limiting or request size limits can provide some level of protection. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
The vulnerability can lead to a denial-of-service condition, rendering the affected server unresponsive and potentially impacting the overall system's performance.
An attacker can exploit this vulnerability by sending large multipart/form-data, causing the HTTP server to open a significant number of file descriptors and exhausting system resources.
Versions prior to 1.6.4 and 1.7.4 of the Go stdlib package are affected by this vulnerability.
Implementing rate limiting or request size limits on the server-side can help mitigate the impact of potential DoS attacks. However, updating to a fixed version of the Go stdlib package is the recommended solution.
You can find more information about this vulnerability in the Go vulnerability database: https://pkg.go.dev/vuln/GO-2021-0172
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
