When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.
Advisories
Source ID Title
EUVD EUVD EUVD-2023-49589 When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.
Ubuntu USN Ubuntu USN USN-6886-1 Go vulnerabilities
Ubuntu USN Ubuntu USN USN-7109-1 Go vulnerabilities
Ubuntu USN Ubuntu USN USN-7111-1 Go vulnerabilities
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

Fri, 27 Jun 2025 11:45:00 +0900

Type Values Removed Values Added
First Time appeared Redhat ceph Storage
CPEs cpe:/a:redhat:ceph_storage:8.1::el9
Vendors & Products Redhat ceph Storage

Thu, 14 Nov 2024 11:45:00 +0900

Type Values Removed Values Added
First Time appeared Redhat openstack Podified
CPEs cpe:/a:redhat:openstack_podified:1.0::el9
Vendors & Products Redhat openstack Podified

Thu, 07 Nov 2024 20:15:00 +0900

Type Values Removed Values Added
Weaknesses CWE-770
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}


Thu, 17 Oct 2024 00:15:00 +0900

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.17::el9
cpe:/a:redhat:run_once_duration_override_operator:1.2::el9

Thu, 03 Oct 2024 00:00:00 +0900

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.16::el9

Fri, 06 Sep 2024 23:00:00 +0900

Type Values Removed Values Added
First Time appeared Redhat openshift Builds
CPEs cpe:/a:redhat:openshift_builds:1.1::el9
Vendors & Products Redhat openshift Builds

Thu, 29 Aug 2024 19:45:00 +0900

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.12::el9

Fri, 23 Aug 2024 04:00:00 +0900

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.13::el8
cpe:/a:redhat:openshift:4.13::el9
cpe:/a:redhat:openshift:4.14::el8
cpe:/a:redhat:openshift:4.14::el9
cpe:/a:redhat:openshift:4.15::el8
cpe:/a:redhat:openshift:4.15::el9

Tue, 20 Aug 2024 07:45:00 +0900

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.12::el8

Thu, 08 Aug 2024 08:00:00 +0900

Type Values Removed Values Added
First Time appeared Redhat rhel Eus
CPEs cpe:/a:redhat:rhel_eus:8.8
cpe:/a:redhat:rhel_eus:9.2
Vendors & Products Redhat rhel Eus

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Go

Published:

Updated: 2025-02-13T17:14:02.493Z

Reserved: 2023-10-06T17:06:26.221Z

Link: CVE-2023-45290

cve-icon Vulnrichment

Updated: 2024-08-02T20:21:15.331Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2024-03-05T23:15:07.210

Modified: 2024-11-21T08:26:42.853

Link: CVE-2023-45290

cve-icon Redhat

Severity : Moderate

Publid Date: 2024-03-05T00:00:00Z

Links: CVE-2023-45290 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses