CVE-2023-24536: Denial of Service Vulnerability in stdlib
Summary
CVE-2023-24536: Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. Affects golang-1.15 versions < ca305e101d89969b5cc6a812b1f12038b769aaa2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package is a part of the Go programming language standard library. It provides a collection of commonly used functions and types that are essential for building Go applications. The package includes modules for networking, text processing, and multipart form parsing, among others. This vulnerability specifically affects the net/http, net/textproto, and mime/multipart modules in the stdlib package.
Vulnerability Detail
Multipart form parsing in the affected modules can lead to excessive resource consumption, resulting in a denial of service (DoS) attack. The vulnerability arises from several factors, including the undercounting of memory consumption, increased pressure on the garbage collector, and the allocation of numerous short-lived buffers. An attacker can exploit this vulnerability to cause a program that parses multipart forms to consume significant amounts of CPU and memory, potentially leading to a DoS condition. The vulnerability impacts programs that use mime/multipart.Reader.ReadForm and form parsing in the net/http package with various methods.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Updating the stdlib package to the fixed versions is the recommended solution.
Conclusion
The stdlib package in Go is susceptible to a denial of service vulnerability when parsing multipart form data. This can result in excessive resource consumption, potentially leading to a DoS condition. To mitigate this vulnerability, it is crucial to update the stdlib package to the fixed versions and review any code that relies on the affected modules. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang-1.15 →
FAQ
The vulnerability affects stdlib package version 1.18.2.
The vulnerability can lead to a denial of service (DoS) condition, causing affected programs to consume excessive CPU and memory resources.
There are no known public exploits for this vulnerability at the time of this report.
Yes, this vulnerability can be exploited remotely by sending specially crafted multipart form inputs to the affected programs.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for golang-1.15.
