CVE-2023-24536: Vulnerability in golang package - Multipart Form Parsing
Summary
CVE-2023-24536: Excessive resource consumption in net/http, net/textproto and mime/multipart. Affects golang across 2 version ranges.
< 1.19.8
>= 1.20.0, < 1.20.3
Fixed in 1.19.8 or 1.20.3, depending on the release line you run. How to fix ↓
Also tracked for
- golang-1.15 · Debian:11
- stdlib · Go
The same CVE-2023-24536 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The golang package is a popular open-source programming language that is widely used for developing efficient and scalable applications. It provides a rich set of libraries and tools for various purposes. However, the package is vulnerable to a specific issue related to multipart form parsing.
Vulnerability Detail
The vulnerability in the golang package arises from the way multipart form inputs with a large number of parts are processed. There are several causes for this issue: 1. The function mime/multipart.Reader.ReadForm, which is used for parsing multipart forms, has a limitation on the total memory consumption. However, this limitation can be bypassed due to an undercounting of memory consumed, allowing larger inputs than intended. 2. The limitation on total memory does not consider the increased pressure on the garbage collector caused by numerous small allocations in forms with many parts. 3. ReadForm can allocate a significant number of short-lived buffers, further straining the garbage collector. These factors combined can lead to a denial of service (DoS) situation, where an attacker can cause the program parsing multipart forms to consume excessive CPU and memory resources. This vulnerability affects programs that utilize mime/multipart.Reader.ReadForm, as well as form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.19.81.19.8 -
>= 1.20.0, < 1.20.31.20.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users are advised to update their golang package to the fixed versions mentioned below.
Conclusion
The golang package is susceptible to a vulnerability related to multipart form parsing, which can lead to a denial of service (DoS) situation. To mitigate this issue, users are advised to update their golang package to the fixed versions 1.19.8 or 1.20.3. Additionally, the fixed versions impose certain limits on the size of parsed forms. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang →
FAQ
This vulnerability can lead to a denial of service (DoS) situation, where an attacker can cause the program parsing multipart forms to consume excessive CPU and memory resources, potentially resulting in the unavailability of the affected application.
Programs that use the mime/multipart.Reader.ReadForm function, as well as form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue, are affected by this vulnerability.
The fixed versions of the golang package are 1.19.8 and 1.20.3. Users are advised to update to these versions or later to mitigate the vulnerability.
Yes, the limits on parsed forms can be adjusted using the environment variables GODEBUG=multipartmaxparts= and GODEBUG=multipartmaxheaders= for the maximum number of parts and header fields, respectively.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert provides real-time monitoring and alerts for open-source vulnerabilities without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
