Back to search
CVE-2025-61726
Published: Jan 28, 2026
Modified: Jan 29, 2026
PUBLISHED
Description
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.
| Vendor | Product | Versions |
|---|---|---|
Go standard library | net/url | affected 0 - < 1.24.12affected 1.25.0 - < 1.25.6 |
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now