Skip to content

Commit 28f31c8

Browse files
neildgopherbot
neild
authored and
gopherbot
committed
data/reports: add GO-2025-4012
 - data/reports/GO-2025-4012.yaml Fixes #4012 Change-Id: I17780d27608929da7ca5ca92f4e7be9a502f9862 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/715980 Auto-Submit: Damien Neil <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Roland Shoemaker <[email protected]>
1 parent 9a9ccd8 commit 28f31c8

File tree

3 files changed

+261
-0
lines changed

3 files changed

+261
-0
lines changed

‎data/cve/v5/GO-2025-4012.json‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
{
2+
"dataType": "CVE_RECORD",
3+
"dataVersion": "5.0",
4+
"cveMetadata": {
5+
"cveId": "CVE-2025-58186"
6+
},
7+
"containers": {
8+
"cna": {
9+
"providerMetadata": {
10+
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc"
11+
},
12+
"title": "Lack of limit when parsing cookies can cause memory exhaustion in net/http",
13+
"descriptions": [
14+
{
15+
"lang": "en",
16+
"value": "Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as \"a=;\", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption."
17+
}
18+
],
19+
"affected": [
20+
{
21+
"vendor": "Go standard library",
22+
"product": "net/http",
23+
"collectionURL": "https://pkg.go.dev",
24+
"packageName": "net/http",
25+
"versions": [
26+
{
27+
"version": "0",
28+
"lessThan": "1.24.8",
29+
"status": "affected",
30+
"versionType": "semver"
31+
},
32+
{
33+
"version": "1.25.0",
34+
"lessThan": "1.25.2",
35+
"status": "affected",
36+
"versionType": "semver"
37+
}
38+
],
39+
"programRoutines": [
40+
{
41+
"name": "ParseCookie"
42+
},
43+
{
44+
"name": "readSetCookies"
45+
},
46+
{
47+
"name": "readCookies"
48+
},
49+
{
50+
"name": "Client.Do"
51+
},
52+
{
53+
"name": "Client.Get"
54+
},
55+
{
56+
"name": "Client.Head"
57+
},
58+
{
59+
"name": "Client.Post"
60+
},
61+
{
62+
"name": "Client.PostForm"
63+
},
64+
{
65+
"name": "Get"
66+
},
67+
{
68+
"name": "Head"
69+
},
70+
{
71+
"name": "Post"
72+
},
73+
{
74+
"name": "PostForm"
75+
},
76+
{
77+
"name": "Request.Cookie"
78+
},
79+
{
80+
"name": "Request.Cookies"
81+
},
82+
{
83+
"name": "Request.CookiesNamed"
84+
},
85+
{
86+
"name": "Response.Cookies"
87+
}
88+
],
89+
"defaultStatus": "unaffected"
90+
}
91+
],
92+
"problemTypes": [
93+
{
94+
"descriptions": [
95+
{
96+
"lang": "en",
97+
"description": "CWE-400: Uncontrolled Resource Consumption"
98+
}
99+
]
100+
}
101+
],
102+
"references": [
103+
{
104+
"url": "https://go.dev/issue/75672"
105+
},
106+
{
107+
"url": "https://go.dev/cl/709855"
108+
},
109+
{
110+
"url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"
111+
},
112+
{
113+
"url": "https://pkg.go.dev/vuln/GO-2025-4012"
114+
}
115+
],
116+
"credits": [
117+
{
118+
"lang": "en",
119+
"value": "jub0bs"
120+
}
121+
]
122+
}
123+
}
124+
}

‎data/osv/GO-2025-4012.json‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-4012",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-58186",
8+
"CVE-2025-58186"
9+
],
10+
"summary": "Lack of limit when parsing cookies can cause memory exhaustion in net/http",
11+
"details": "Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as \"a=;\", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "stdlib",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "1.24.8"
27+
},
28+
{
29+
"introduced": "1.25.0"
30+
},
31+
{
32+
"fixed": "1.25.2"
33+
}
34+
]
35+
}
36+
],
37+
"ecosystem_specific": {
38+
"imports": [
39+
{
40+
"path": "net/http",
41+
"symbols": [
42+
"Client.Do",
43+
"Client.Get",
44+
"Client.Head",
45+
"Client.Post",
46+
"Client.PostForm",
47+
"Get",
48+
"Head",
49+
"ParseCookie",
50+
"Post",
51+
"PostForm",
52+
"Request.Cookie",
53+
"Request.Cookies",
54+
"Request.CookiesNamed",
55+
"Response.Cookies",
56+
"readCookies",
57+
"readSetCookies"
58+
]
59+
}
60+
]
61+
}
62+
}
63+
],
64+
"references": [
65+
{
66+
"type": "REPORT",
67+
"url": "https://go.dev/issue/75672"
68+
},
69+
{
70+
"type": "FIX",
71+
"url": "https://go.dev/cl/709855"
72+
},
73+
{
74+
"type": "WEB",
75+
"url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"
76+
}
77+
],
78+
"credits": [
79+
{
80+
"name": "jub0bs"
81+
}
82+
],
83+
"database_specific": {
84+
"url": "https://pkg.go.dev/vuln/GO-2025-4012",
85+
"review_status": "REVIEWED"
86+
}
87+
}

‎data/reports/GO-2025-4012.yaml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
id: GO-2025-4012
2+
modules:
3+
- module: std
4+
versions:
5+
- fixed: 1.24.8
6+
- introduced: 1.25.0
7+
- fixed: 1.25.2
8+
vulnerable_at: 1.25.1
9+
packages:
10+
- package: net/http
11+
symbols:
12+
- ParseCookie
13+
- readSetCookies
14+
- readCookies
15+
derived_symbols:
16+
- Client.Do
17+
- Client.Get
18+
- Client.Head
19+
- Client.Post
20+
- Client.PostForm
21+
- Get
22+
- Head
23+
- Post
24+
- PostForm
25+
- Request.Cookie
26+
- Request.Cookies
27+
- Request.CookiesNamed
28+
- Response.Cookies
29+
summary: Lack of limit when parsing cookies can cause memory exhaustion in net/http
30+
description: |-
31+
Despite HTTP headers having a default limit of 1MB, the number
32+
of cookies that can be parsed does not have a limit.
33+
By sending a lot of very small cookies such as "a=;", an attacker
34+
can make an HTTP server allocate a large amount of structs,
35+
causing large memory consumption.
36+
cves:
37+
- CVE-2025-58186
38+
credits:
39+
- jub0bs
40+
references:
41+
- report: https://go.dev/issue/75672
42+
- fix: https://go.dev/cl/709855
43+
- web: https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI
44+
cve_metadata:
45+
id: CVE-2025-58186
46+
cwe: 'CWE-400: Uncontrolled Resource Consumption'
47+
source:
48+
id: go-security-team
49+
created: 2025-10-28T18:32:51.715588-07:00
50+
review_status: REVIEWED

0 commit comments

Comments
 (0)