CVE-2025-61726: Memory exhaustion in query parameter parsing in net/url
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61726?
CVE-2025-61726 has been classified as a moderate severity vulnerability due to its potential for causing memory exhaustion.
How do I fix CVE-2025-61726?
To mitigate CVE-2025-61726, implement input validation to limit the number of query parameters processed in your application.
Which software versions are affected by CVE-2025-61726?
CVE-2025-61726 affects all versions of the net/url package that do not impose limitations on query parameters.
What are the potential impacts of CVE-2025-61726?
The potential impacts of CVE-2025-61726 include denial of service through memory exhaustion in applications utilizing the affected net/url package.
Is CVE-2025-61726 related to web application security?
Yes, CVE-2025-61726 is directly related to web application security as it involves query parameter parsing in HTTP requests.