CVE-2023-24534: Excessive memory allocation in net/http and net/textproto
Summary
CVE-2023-24534: Excessive memory allocation in net/http and net/textproto. Affects stdlib across 2 version ranges.
< 1.19.8
>= 1.20.0-0, < 1.20.3
Fixed in 1.19.8 or 1.20.3, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2023-24534 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package in Go is a collection of standard libraries that provide fundamental functionality for Go programs. It includes the net/http and net/textproto packages, which are responsible for handling HTTP and MIME headers. These packages are widely used in Go applications to implement HTTP servers and clients.
Vulnerability Detail
The HTTP and MIME header parsing in net/http and net/textproto can lead to excessive memory allocation, potentially resulting in a denial of service (DoS) attack. When parsing headers, even for small inputs, the parsing function may allocate a large amount of memory. This behavior can be exploited by an attacker to cause an HTTP server to allocate excessive memory from a small request, leading to memory exhaustion and a DoS condition. The vulnerability arises from certain unusual patterns of input data that cause the parsing function to allocate more memory than necessary.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.19.81.19.8go get stdlib@v1.19.8 -
>= 1.20.0-0, < 1.20.31.20.3go get stdlib@v1.20.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the affected Go package to the fixed version as soon as possible.
Conclusion
The excessive memory allocation vulnerability in net/http and net/textproto can lead to a denial of service attack by causing an HTTP server to allocate excessive memory from a small request. To mitigate this vulnerability, it is essential to update the affected Go package to version 1.19.8 or 1.20.3. This update ensures that header parsing correctly allocates only the necessary memory. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
This vulnerability can lead to a denial of service (DoS) attack by causing an HTTP server to allocate excessive memory from a small request, resulting in memory exhaustion and unavailability of the server.
The vulnerability affects the stdlib package in Go, specifically the net/http and net/textproto packages.
No, not all versions are vulnerable. The vulnerability was introduced in version 1.20.0-0 and fixed in versions 1.19.8 and 1.20.3.
There is no known exploit at the moment. However, it is crucial to update the affected package to the fixed version to prevent potential exploitation.
No, updating the affected package to the fixed version is the only known mitigation for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
