CVE-2023-24536: Excessive resource consumption in net/http, net/textproto and mime/multipart
Excessive resource consumption in net/http, net/textproto and mime/multipart
Other sources
Golang Go is vulnerable to a denial of service, caused by a flaw during multipart form parsing. By sending a specially crafted input, a remote attacker could exploit this vulnerability to consume large amounts of CPU and memory, and results in a denial of service condition.
— IBM
Multipart form parsing can consume large amounts of CPU and memory whe ...
— Debian
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-24536?
CVE-2023-24536 is a vulnerability that allows for consuming large amounts of CPU and memory during multipart form parsing.
What is the severity of CVE-2023-24536?
CVE-2023-24536 has a severity rating of 7.5 (High).
How does CVE-2023-24536 affect the affected software?
CVE-2023-24536 affects the affected software by causing excessive consumption of CPU and memory when processing multipart form inputs with a large number of parts.
How can I fix CVE-2023-24536?
To fix CVE-2023-24536, update the affected software to version 1.20.3 (for Red Hat's golang package) or version 1.19.8 (for Golang Go).
Where can I find more information about CVE-2023-24536?
You can find more information about CVE-2023-24536 at the following references: [Reference 1](https://go.dev/cl/482075), [Reference 2](https://go.dev/cl/482076), [Reference 3](https://go.dev/cl/482077).