PkgSeer

Vulnerability GO-2026-4341

Unknown

8 months ago

Memory exhaustion in query parameter parsing in net/url

<1.24.12

Summary

Memory exhaustion in query parameter parsing in net/url

Details

The net/url package does not set a limit on the number of query parameters in a query.

While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Enforce maximum recursion depth in encoding/asn1

<1.25.13 GO-2026-5972

Add recursion depth guard during decode in encoding/xml

<1.25.13 GO-2026-6088

Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

<1.25.13 GO-2026-6089

Limit handshake messages we are willing to accept post-handshake in crypto/tls

<1.25.13 GO-2026-6090

Fix Javascript regexp context tracking in html/template

<1.25.13 GO-2026-6091

View all vulnerabilities for these packages

Impacted packages

stdlib

Timeline

Published

8 months ago

Last Modified

2 hours ago