CVE-2023-24536

Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the total memory a parsed multipart form can consume. ReadForm can undercount the amount of memory consumed, leading it to accept larger inputs than intended. 2. Limiting total memory does not account for increased pressure on the garbage collector from large numbers of small allocations in forms with many parts. 3. ReadForm can allocate a large number of short-lived buffers, further increasing pressure on the garbage collector. The combination of these factors can permit an attacker to cause an program that parses multipart forms to consume large amounts of CPU and memory, potentially resulting in a denial of service. This affects programs that use mime/multipart.Reader.ReadForm, as well as form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. With fix, ReadForm now does a better job of estimating the memory consumption of parsed forms, and performs many fewer short-lived allocations. In addition, the fixed mime/multipart.Reader imposes the following limits on the size of parsed forms: 1. Forms parsed with ReadForm may contain no more than 1000 parts. This limit may be adjusted with the environment variable GODEBUG=multipartmaxparts=. 2. Form parts parsed with NextPart and NextRawPart may contain no more than 10,000 header fields. In addition, forms parsed with ReadForm may contain no more than 10,000 header fields across all parts. This limit may be adjusted with the environment variable GODEBUG=multipartmaxheaders=.

• CWE-770
• CWE-770

• https://go.dev/cl/482075Patch
• https://go.dev/cl/482076Patch
• https://go.dev/cl/482077Patch
• https://go.dev/issue/59153Issue Tracking, Patch
• https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8Mailing List
• https://pkg.go.dev/vuln/GO-2023-1705Vendor Advisory
• https://security.gentoo.org/glsa/202311-09
• https://security.netapp.com/advisory/ntap-20230526-0007/
• https://go.dev/cl/482075Patch
• https://go.dev/cl/482076Patch
• https://go.dev/cl/482077Patch
• https://go.dev/issue/59153Issue Tracking, Patch
• https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8Mailing List
• https://pkg.go.dev/vuln/GO-2023-1705Vendor Advisory
• https://security.gentoo.org/glsa/202311-09
• https://security.netapp.com/advisory/ntap-20230526-0007/

Published

Apr 6, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-24530SAP BusinessObjects Business Intelligence Platform (CMC) - v…9.1
• CVE-2023-24531Command go env is documented as outputting a shell script co…9.8
• CVE-2023-24532The ScalarMult and ScalarBaseMult methods of the P256 Curve …5.3
• CVE-2023-24533Multiplication of certain unreduced P-256 scalars produce in…7.5
• CVE-2023-24534HTTP and MIME header parsing can allocate large amounts of m…7.5
• CVE-2023-24535Parsing invalid messages can panic. Parsing a text-format me…7.5
• CVE-2023-24537Calling any of the Parse functions on Go source code which c…7.5
• CVE-2023-24538Templates do not properly consider backticks (`) as Javascri…9.8
• CVE-2023-24539Angle brackets (<>) are not considered dangerous characters …7.3
• CVE-2023-2454schema_element defeats protective search_path changes; It wa…7.2
• CVE-2023-24540Not all valid JavaScript whitespace characters are considere…9.8
• CVE-2023-24542Unquoted search path or element in some Intel(R) Thunderbolt…6.7