CVE-2023-45290

When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.

• CWE-770

• http://www.openwall.com/lists/oss-security/2024/03/08/4
• https://go.dev/cl/569341
• https://go.dev/issue/65383
• https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
• https://pkg.go.dev/vuln/GO-2024-2599
• https://security.netapp.com/advisory/ntap-20240329-0004/
• http://www.openwall.com/lists/oss-security/2024/03/08/4
• https://go.dev/cl/569341
• https://go.dev/issue/65383
• https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
• https://pkg.go.dev/vuln/GO-2024-2599
• https://security.netapp.com/advisory/ntap-20240329-0004/

Published

Mar 5, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-45284On Windows, The IsLocal function does not correctly detect r…5.3
• CVE-2023-45285Using go get to fetch a module with the ".git" suffix may un…7.5
• CVE-2023-45286A race condition in go-resty can result in HTTP request body…5.9
• CVE-2023-45287Before Go 1.20, the RSA based TLS key exchanges used the mat…7.5
• CVE-2023-45288An attacker may cause an HTTP/2 endpoint to read arbitrary a…7.5
• CVE-2023-45289When following an HTTP redirect to a domain which is not a s…4.3
• CVE-2023-45291Rejected reason: reserved but not needed
• CVE-2023-45292When using the default implementation of Verify to check a C…5.3
• CVE-2023-4530Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2023-45303ThingsBoard before 3.5 allows Server-Side Template Injection…8.8
• CVE-2023-4531Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2023-45311fsevents before 1.2.11 depends on the https://fsevents-binar…9.8