CVE-2023-24534: Excessive memory allocation in net/http and net/textproto
Vulnerability summary
CVE-2023-24534 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in go standard library net/textproto. EPSS estimates a 1.89% chance of exploitation in the next 30 days, higher than 79.5% of scored vulnerabilities.
Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 2% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 33 · Related 16Timeline
- 06-04-2023PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service. With fix, header parsing now correctly allocates only the memory required to hold parsed headers.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.89%
Chance of exploitation in the next 30 days
Percentile
80%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.89% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard11 products
- go-1.20< 1.20.3-r1
- katib-earlystopping< 0.19.0-r31
- katib-suggestion-goptuna-compatAll versions (No fix recorded)
- katib-suggestion-hyperband< 0.19.0-r31
- katib-suggestion-hyperopt< 0.19.0-r40 | < 0.19.0-r31
Wolfi11 products
- go-1.20< 1.20.3-r1
- katib-earlystopping< 0.19.0-r31
- katib-suggestion-goptuna-compatAll versions (No fix recorded)
- katib-suggestion-hyperband< 0.19.0-r31
- katib-suggestion-hyperopt< 0.19.0-r40 | < 0.19.0-r31
Ubuntu9 products
- golang-1.10All versions (No fix recorded)
- golang-1.13< 1.13.8-1ubuntu1~16.04.3+esm3 | < 1.13.8-1ubuntu1~18.04.4+esm1 | < 1.13.8-1ubuntu1.2 | < 1.13.8-1ubuntu2.22.04.2
- golang-1.14All versions (No fix recorded)
- golang-1.16< 1.16.2-0ubuntu1~18.04.2+esm1 | < 1.16.2-0ubuntu1~20.04.1
- golang-1.17All versions (No fix recorded)
Alpine3 products
- go≥ 1.20.0, < 1.19.8-r0 | ≥ 1.20.0, < 1.20.3-r0
- nomad< 1.4.8-r0 | < 1.5.3-r0
- traefik< 2.9.10-r0
Debian1 product
- golang-1.19< 1.19.8-2
Go1 product
- stdlib≥ 1.20.0-0, < 1.20.3
Go standard library1 product
- net/textproto< 1.19.8 | ≥ 1.20.0-0, < 1.20.3
Golang1 product
- go< 1.19.8 | ≥ 1.20.0, < 1.20.3
8 vendors · 38 products
References
18 linksShow all 18 references
- pkg.go.devWEB
