Resource exhaustion in Go programming language - CVE-2023-45290

Detailed vulnerability description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists in net/http due to application does not properly control consumption of internal resources when parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile). A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

How to mitigate CVE-2023-45290

Sources

• https://go.dev/issue/65383
• https://go.dev/cl/569341
• https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
• https://pkg.go.dev/vuln/GO-2024-2599