CVE-2025-58186: Go stdlib net/http Cookie Parsing Memory Exhaustion Vulnerability
Summary
CVE-2025-58186: Lack of limit when parsing cookies can cause memory exhaustion in net/http. Affects stdlib across 2 version ranges.
< 1.24.8
>= 1.25.0, < 1.25.2
Fixed in 1.24.8 or 1.25.2, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2025-58186 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Go programming language's standard library (stdlib) includes the net/http package, which provides HTTP client and server implementations. This package is widely used for building web applications and services in Go. It facilitates handling HTTP requests and responses, making it essential for developers. However, the package has a vulnerability related to cookie parsing that can lead to memory exhaustion, impacting server performance and stability.
Vulnerability Detail
The vulnerability arises from the lack of a limit on the number of cookies that can be parsed by the net/http package. Despite HTTP headers having a default size limit of 1MB, an attacker can exploit this by sending numerous small cookies, such as 'a=;', causing the server to allocate excessive memory for cookie structures. This can lead to significant memory consumption, potentially resulting in denial of service as the server becomes overwhelmed.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.24.81.24.8go get stdlib@v1.24.8 -
>= 1.25.0, < 1.25.21.25.2go get stdlib@v1.25.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can limit the number of cookies your application accepts or implement custom logic to handle cookie parsing more securely. However, the best solution is to update to the patched version of the Go standard library.
Conclusion
The CVE-2025-58186 vulnerability in the Go stdlib net/http package poses a significant risk due to its potential for memory exhaustion. It is crucial for developers to update to the latest patched versions to ensure the security and stability of their applications. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for stdlib →
FAQ
CVE-2025-58186 is a vulnerability in the Go standard library's net/http package that allows an attacker to exhaust server memory by sending numerous small cookies.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities without requiring sign-up.
Versions of Go prior to 1.24.8 and 1.25.2 are affected by this vulnerability.
The consequences include potential denial of service due to excessive memory consumption, which can lead to server crashes or degraded performance.
You can mitigate the vulnerability by limiting the number of cookies your application processes or implementing custom cookie handling logic.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
