QwikSec

Security Database

CVE

CWE

Training

CVE-2017-1000098

Published: Oct 4, 2017

Modified: Sep 16, 2024

PUBLISHED

Description

The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "maxMemory" limit. It was possible for an attacker to generate a multipart request crafted such that the server ran out of file descriptors.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://groups.google.com/forum/#%21msg/golang-dev/4NdLzS8sls8/uIz8QlnIBQAJ

x_refsource_CONFIRM

https://golang.org/issue/17965

x_refsource_CONFIRM

https://golang.org/cl/30410

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.