CVE-2025-58186: Lack of limit when parsing cookies can cause memory exhaustion in net/http
Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as "a=;", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption.
Other sources
Lack of limit when parsing cookies can cause memory exhaustion in net/http
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-58186?
CVE-2025-58186 has a high severity level due to its potential to cause significant memory consumption in HTTP servers.
How do I fix CVE-2025-58186?
To mitigate CVE-2025-58186, restrict the number of cookies that can be parsed by the HTTP server.
What is the impact of exploiting CVE-2025-58186?
Exploiting CVE-2025-58186 can lead to denial of service by exhausting server memory resources.
Which software is affected by CVE-2025-58186?
CVE-2025-58186 specifically affects the Google Go programming language.
Can CVE-2025-58186 be exploited remotely?
Yes, CVE-2025-58186 can be exploited remotely by sending specially crafted HTTP requests containing numerous small cookies.