CVE-2023-45290: Memory exhaustion in multipart form parsing in net/textproto and net/http
Last updated 14 November 2024
Other sources
Memory exhaustion in multipart form parsing in net/textproto and net/http
— Microsoft
When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.
— Launchpad
When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permitted a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion.
ParseMultipartForm now correctly limits the maximum size of form lines.
https://github.com/golang/go/issues/65383
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/goto a version that resolves this vulnerability.Fixed in 1.21.8 - Upgrade
Upgrade
redhat/goto a version that resolves this vulnerability.Fixed in 1.22.1
Event History
Frequently Asked Questions
What is the severity of CVE-2023-45290?
CVE-2023-45290 has a high severity level due to its ability to cause denial of service through arbitrary memory allocation.
How do I fix CVE-2023-45290?
To fix CVE-2023-45290, update to Go version 1.21.8 or later, or 1.22.1 or later, depending on your package source.
What software is affected by CVE-2023-45290?
CVE-2023-45290 affects several versions of IBM Concert Software and various versions of Go packages, including golang-1.15, golang-1.19, and golang-1.22.
What could an attacker achieve by exploiting CVE-2023-45290?
An attacker exploiting CVE-2023-45290 could create a denial of service by sending specially crafted input to allocate large amounts of memory.
Is CVE-2023-45290 a remote code execution vulnerability?
No, CVE-2023-45290 is not a remote code execution vulnerability; it leads to denial of service instead.