CVE-2017-1000098

Published: Oct 5, 2017Modified: May 13, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "maxMemory" limit. It was possible for an attacker to generate a multipart request crafted such that the server ran out of file descriptors.

Affected (2)

Products: Golang: Go

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Golang Go	Before 1.6.4
Golang Go	From 1.7 to 1.7.4

Related CWEs

DEPRECATED: Uncontrolled File Descriptor Consumption

This entry has been deprecated because it was a duplicate of CWE-774. All content has been transferred to CWE-774.

References (6)

https://golang.org/cl/30410

Source: cve@mitre.org

Issue TrackingPatchVendor Advisory

https://golang.org/issue/17965

Source: cve@mitre.org

Issue TrackingPatchVendor Advisory

https://groups.google.com/forum/#%21msg/golang-dev/4NdLzS8sls8/uIz8QlnIBQAJ

Source: cve@mitre.org

https://golang.org/cl/30410

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchVendor Advisory

https://golang.org/issue/17965

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchVendor Advisory

https://groups.google.com/forum/#%21msg/golang-dev/4NdLzS8sls8/uIz8QlnIBQAJ

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.