CVE-2023-24536: Excessive resource consumption in net/http, net/textproto and mime/multipart
Summary
CVE-2023-24536: Excessive resource consumption in net/http, net/textproto and mime/multipart. Affects stdlib across 2 version ranges.
< 1.19.8
>= 1.20.0-0, < 1.20.3
Fixed in 1.19.8 or 1.20.3, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2023-24536 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The impacted package is the standard library package 'stdlib' in the Go ecosystem. This package provides a collection of modules and functions that are commonly used in Go programs. It includes the net/http, net/textproto, and mime/multipart packages, which are responsible for handling HTTP requests, parsing MIME headers, and processing multipart form data, respectively. These packages are widely used in Go applications for web development and data processing.
Vulnerability Detail
The vulnerability in the impacted package arises from the way multipart form parsing is handled. When processing form inputs with a large number of parts, it can lead to excessive consumption of CPU and memory resources. This is caused by several factors, including the undercounting of memory consumption by the mime/multipart.Reader.ReadForm function, the lack of accounting for increased garbage collector pressure from small allocations, and the allocation of numerous short-lived buffers. An attacker can exploit this vulnerability to launch a denial-of-service attack by causing the program to consume significant amounts of CPU and memory. The vulnerability affects programs that use mime/multipart.Reader.ReadForm and form parsing functions in the net/http package, such as FormFile, FormValue, ParseMultipartForm, and PostFormValue.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.19.81.19.8go get stdlib@v1.19.8 -
>= 1.20.0-0, < 1.20.31.20.3go get stdlib@v1.20.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the impacted package is not immediately feasible, a possible workaround is to implement custom form parsing logic that avoids using the vulnerable functions. This can involve directly parsing the multipart form data using alternative libraries or implementing a custom parser. However, it is recommended to update to the fixed version of the impacted package as soon as possible.
Conclusion
In conclusion, the impacted package in the Go ecosystem is vulnerable to excessive resource consumption when parsing multipart forms. This can be exploited by an attacker to cause a denial-of-service condition. To address this vulnerability, it is crucial to update the impacted package to the fixed version and ensure the implementation of proper form parsing logic. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
The vulnerability affects versions of the impacted package prior to 1.19.8 for Go 1.19.x and prior to 1.20.3 for Go 1.20.x.
The vulnerability can be exploited by an attacker to cause a denial-of-service condition in programs that parse multipart forms. This can result in excessive consumption of CPU and memory resources, leading to degraded performance or unavailability of the affected application.
The recommended mitigation is to update the impacted package to the fixed version. Implementing custom form parsing logic or applying other workarounds may provide temporary relief but are not a substitute for the official fix.
Yes, this vulnerability can be exploited remotely by sending specially crafted multipart form data to the affected application's endpoints that utilize the vulnerable functions for form parsing.
At the time of this report, there is no known evidence of active exploits targeting this vulnerability. However, it is advisable to apply the fix promptly to mitigate any potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
