CVE-2022-41725: Denial of Service in stdlib package
Summary
CVE-2022-41725: A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Affects golang-1.15 versions < 8656c03fee94ce9cdc4da120b831c2fb9fd68d9d. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package is a part of the Go programming language and provides a set of standard libraries for various functionalities. It includes modules for networking, file handling, encoding, and more. The vulnerability identified as CVE-2022-41725 affects the net/http and mime/multipart modules in the stdlib package. These modules handle HTTP requests and multipart form data parsing, respectively.
Vulnerability Detail
The vulnerability allows for a denial of service attack by exploiting excessive resource consumption in the net/http and mime/multipart modules. Specifically, the multipart form parsing function, mime/multipart.Reader.ReadForm, can consume large amounts of memory and disk files. This vulnerability also affects form parsing in the net/http package with various request methods. The ReadForm function did not properly account for all memory consumed by a parsed form, allowing a maliciously crafted form to consume well over the documented limit. Additionally, ReadForm did not limit the number of disk files created, enabling a small request body to create a large number of temporary files.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by implementing additional security measures such as rate limiting or request size limitations in their applications.
Conclusion
The CVE-2022-41725 vulnerability in the stdlib package exposes a denial of service risk due to excessive resource consumption. Users are advised to update to the fixed versions of the stdlib package and implement additional security measures to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang-1.15 →
FAQ
The vulnerability can be exploited to launch a denial of service attack, causing excessive resource consumption and potentially leading to service unavailability.
The vulnerability is present in version 1.18.2 of the stdlib package. It is recommended to update to version 1.19.6 or 1.20.1 to fix the issue.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity level.
Yes, the vulnerability can be exploited remotely by sending maliciously crafted HTTP requests or multipart form data.
With the fix, ReadForm now creates at most one on-disk temporary file, combining multiple form parts into a single temporary file. The previous behavior of using distinct files for each form part may be reenabled with the environment variable GODEBUG=multipartfiles=distinct.
Related vulnerabilities
Recent vulnerabilities recorded for golang-1.15.
