CVE-2023-45290: Memory exhaustion in multipart form parsing in net/textproto and net/http

Deferred

AliasesRHSA-2024:3830RHSA-2024:3831UBUNTU-CVE-2023-45290+684 more

Published 05-03-2024Last modified 13-02-2025

Vulnerability summary

CVE-2023-45290 is a medium (CVSS 6.5) vulnerability in go standard library net/textproto. EPSS estimates a 1.17% chance of exploitation in the next 30 days, higher than 67.3% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.5/10

010

Medium · v3.1 (CVE.org)

EPSS score

1.17%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 35 · Related 480

MGASA-2024-0343 OPENSUSE-SU-2024:13752-1 OPENSUSE-SU-2024:13756-1 RHSA-2024:0045 RHSA-2024:2562 RHSA-2024:2724+94 more

Showing 100 of 481.

Timeline

05-03-2024
PublishedVulnerability first disclosed.
13-02-2025
Last modifiedVulnerability information updated.

Description

When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.

CVSS metrics

6 scores · 6 sources · 1 version

v3.16.5

EPSS trend

Probability

1.17%

Chance of exploitation in the next 30 days

Percentile

67%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.17% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected systems

Version check

Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard199 products

actions-runner-controller< 0.8.3-r1
amass< 4.2.0-r4
argo-workflows< 3.6.5-r2
argo-workflows-fips< 3.5.5-r1
atlantis-fips< 0.33.0-r6

aws-ebs-csi-driver< 1.28.0-r1
aws-efs-csi-driver< 1.7.6-r1
aws-efs-csi-driver-fips< 1.7.0-r4
aws-flb-cloudwatch< 1.9.4-r7
aws-flb-firehose< 1.7.2-r7
aws-flb-kinesis< 1.10.2-r7
aws-load-balancer-controller< 2.7.1-r1
aws-load-balancer-controller-fips< 2.7.1-r1
azure-aad-pod-identity-mic< 1.8.17-r5
bank-vaults-fips< 1.20.4-r5
bazelisk< 1.19.0-r1
bom< 0.6.0-r1
boring-registry-fips< 0.13.2-r1
buildkitd< 0.13.1-r2
caddy< 2.7.6-r3
cadvisor< 0.49.1-r3
cadvisor-compat< 0.49.1-r3
capslock< 0.2.1-r1
cass-operator< 1.18.2-r4
cass-operator-fips< 1.18.2-r3
cass-operator-fips-no-pvc-delete< 1.18.2-r4
cert-exporter< 2.12.0-r1
cert-exporter-fips< 2.12.0-r1
cfssl< 1.6.5-r0
chainctl< 0.2.59-r0
chartmuseum< 0.16.1-r4
cloud-sql-proxy-fips< 2.8.2-r1
cluster-autoscaler-1.27< 1.27.5-r2
cluster-autoscaler-1.27-compat< 1.27.5-r2
cluster-autoscaler-1.28< 1.28.2-r2
cluster-autoscaler-1.28-compat< 1.28.2-r2
cluster-proportional-autoscaler< 1.8.11-r1
cni-plugins< 1.4.0-r2
cni-plugins-fips< 1.4.0-r2
configmap-reload< 0.12.0-r4
configmap-reload-fips< 0.12.0-r3
configmap-reload-fips-0.11< 0.11.1-r4
controller-gen< 0.14.0-r1
cortex< 1.16.0-r2
cri-tools< 1.29.0-r4
crossplane-provider-azure< 0.42.1-r1
ctop< 0.7.7-r11
cue< 0.7.1-r1
cue-fips< 0.7.1-r1
dagger< 0.10.1-r1
dask-gateway< 2024.1.0-r2
dataplaneapi< 2.9.1-r1
delve< 1.22.1-r1
dex< 2.38.0-r1
dex-k8s-authenticator< 1.4.0-r7
dgraph< 23.1.0-r5
direnv< 2.34.0-r1
dive< 0.12.0-r1
docker-cli< 24.0.6-r2
docker-credential-acr-env< 0.7.0-r11
docker-credential-cgr< 0.2.59-r0
docker-credential-ecr-login< 0.7.1-r9
docker-credential-gcr< 2.1.22-r1
dockerize< 0.7.0-r5
dockerize-fips< 0.7.0-r4
doppler-kubernetes-operator< 1.5.0-r1
dynamic-localpv-provisioner< 3.5.0-r4
dynamic-localpv-provisioner-fips< 3.5.0-r1
eksctl< 0.173.0-r1
envoy-ratelimit< 0.0_git20240220-r3
envoy-ratelimit-fips< 0.0_git20231206-r1
esbuild< 0.20.1-r1
etcd-3.5< 3.5.12-r1
external-secrets-fips< 0.9.13-r1
falcoctl-fips-0.4< 0.4.0-r3
ferretdb< 1.20.1-r1
flannel-cni-plugin< 1.4.0-r1
flux< 2.2.3-r1
flux-helm-controller< 0.37.4-r3
flux-image-automation-controller< 0.37.1-r1
flux-image-reflector-controller< 0.31.2-r1
fq< 0.10.0-r1
fulcio-fips< 1.4.4-r1
fuse-overlayfs-snapshotter< 1.0.8-r4
gcsfuse< 1.4.2-r1
gh< 2.45.0-r1
gitness< 3.0.0_beta5-r1
gke-gcloud-auth-plugin< 0.0.2-r7
go-1.20< 1.20.14-r9 | All versions (No fix recorded)
go-bindata< 3.1.3-r16
go-licenses< 1.6.0-r10
go-md2man< 2.0.3-r2
gobuster< 3.6.0-r5
golangci-lint< 1.56.2-r1
gomplate< 3.11.7-r1
gops< 0.3.28-r5
goreleaser< 1.24.0-r1
gosu< 1.17-r3
govulncheck< 1.0.2-r1
grafana-operator< 5.6.3-r1
grafana-operator-fips< 5.6.3-r2
grpcurl< 1.8.9-r3
grype< 0.74.7-r1
haproxy-ingress< 0.14.6-r1
hello-world-golang< 1.3-r1
helm< 3.14.2-r1
helm-3< 3.19.2-r1
helm-4< 4.0.1-r1
helm-operator< 1.34.1-r1
helm-operator-fips< 1.34.1-r1
helm-push< 0.10.4-r4
hey< 0.1.4-r10
http-echo< 1.0.0-r4
hubble-ui< 0.13.0-r1
hubble-ui-backend< 0.13.3-r1
hubble-ui-backend-fips< 0.13.0-r1
influx< 2.7.3-r9
ip-masq-agent< 2.9.3-r7
jsonnet-bundler< 0.5.1-r2
k3d< 5.6.0-r7
k3s< 1.29.2-r1
k8sgpt< 0.3.27-r3
k8sgpt-operator< 0.1.0-r1
k8ssandra-operator< 1.13.0-r1
k8ssandra-operator-fips< 1.13.0-r1
kaf< 0.2.7-r1
kiam< 4.2-r7
kind< 0.22.0-r2
kine< 0.11.3-r2
kor< 0.3.6-r1
kpt< 1.0.0_beta49-r1
kube-bench< 0.7.2-r1
kube-logging-logging-operator-3.17< 3.17.11-r6
kube-logging-logging-operator-4.1< 4.1.0-r4
kube-logging-operator< 4.5.6-r1
kube-oidc-proxy< 1.0.6-r4
kube-rbac-proxy< 0.16.0-r1
kube-rbac-proxy-fips< 0.16.0-r1
kube-state-metrics< 2.11.0-r0
kube-state-metrics-fips< 2.10.1-r3
kubebuilder< 3.14.0-r2
kubeflow-katib< 0.16.0-r5
kubeflow-pipelines< 2.0.5-r4
kuberay-operator< 1.0.0-r2
kubernetes-csi-external-provisioner< 4.0.0-r1
kubernetes-csi-external-resizer< 1.10.0-r2
kubernetes-csi-livenessprobe< 2.12.0-r1
kubernetes-csi-livenessprobe-2.10< 2.10.0-r6
kubernetes-csi-livenessprobe-fips< 2.11.0-r6
kubernetes-csi-livenessprobe-fips-2.10< 2.10.0-r6
kubernetes-dashboard< 2.7.0-r12
kubernetes-dashboard-fips< 2.7.0-r1
kubernetes-dashboard-metrics-scraper< 1.0.9-r11
kubernetes-dashboard-metrics-scraper-compat< 1.0.9-r11
kubernetes-dashboard-metrics-scraper-fips< 1.0.9-r1
kubernetes-dns-node-cache< 1.23.0-r1
kubernetes-event-exporter< 1.7-r2
kubevela< 1.9.9-r2
kubewatch< 2.5.0-r10
kustomize< 5.3.0-r2
kwok< 0.5.1-r1
kyverno-policy-reporter< 2.18.1-r1
kyverno-policy-reporter-kyverno-plugin< 1.6.3-r1
lazygit< 0.40.2-r2
litefs< 0.5.11-r1
local-path-provisioner< 0.0.26-r3
logstash-exporter< 1.6.3-r1
logstash-exporter-fips< 1.6.1-r1
mage< 1.15.0-r5
mc-fips< 0.20240131.085940-r1
memcached-exporter< 0.14.2-r2
metallb< 0.14.3-r1
metrics-server< 0.7.0-r1
metrics-server-fips< 0.6.4-r4
minio< 0.20231220.010002-r3
minio-fips< 0.20240131.202033-r1
mockery< 2.42.0-r1
mongo-tools< 100.9.4-r2
nats< 0.1.3-r1
nats-server< 2.10.11-r1
nerdctl< 1.7.4-r1
newrelic-fluent-bit-output< 1.19.2-r1
newrelic-fluent-bit-output-compat< 2.4.0-r5
newrelic-infra-operator< 0.18.0-r1
newrelic-infrastructure-agent< 1.50.0-r1
newrelic-prometheus-configurator< 1.14.0-r1
nfs-subdir-external-provisioner< 4.0.18-r4
nfs-subdir-external-provisioner-fips< 4.0.18-r3
node-problem-detector-0.8< 0.8.17-r0
nodetaint< 0.0.4-r11
nri-apache< 1.12.3-r1
nri-cassandra< 2.13.4-r1
nri-couchbase< 2.6.1-r5
nri-discovery-kubernetes< 1.7.2-r3
nri-elasticsearch< 5.2.3-r1
nri-f5< 2.7.3-r1
nri-haproxy< 3.0.0-r1
nri-kafka< 3.7.1-r1
nri-memcached< 2.5.3-r1

Show all 199

Alpine1 product

go< 1.21.8-r0 | < 1.22.1-r0

2 vendors · 200 products · Showing 200 of 569

References

25 links

go.dev/issue/65383ARTICLEREPORT
go.dev/cl/569341ARTICLEREPORTFIX
groups.google.com/g/golang-announce/c/5pwGVUPoMbgARTICLEREPORTWEB
pkg.go.dev/vuln/GO-2024-2599AdvisoryREPORT
security.netapp.com/advisory/ntap-20240329-0004/
www.openwall.com/lists/oss-security/2024/03/08/4ARTICLE
access.redhat.com/errata/RHSA-2024:3830Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2268017REPORT
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3830.jsonAdvisory

Show all 25 references

access.redhat.com/security/cve/CVE-2023-45290REPORT
www.cve.org/CVERecord?id=CVE-2023-45290AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2023-45290AdvisoryOval
security.netapp.com/advisory/ntap-20240329-0004ARTICLE
access.redhat.com/errata/RHSA-2024:3831Advisory
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3831.jsonAdvisory
ubuntu.com/security/CVE-2023-45290REPORT
github.com/golang/go/issues/65383REPORT
github.com/golang/go/commit/041a47712e765e94f86d841c3110c840e76d8f82REPORT
github.com/golang/go/commit/bf80213b121074f4ad9b449410a4d13bae5e9be0REPORT
ubuntu.com/security/notices/USN-6886-1Advisory
ubuntu.com/security/notices/USN-7109-1Advisory
ubuntu.com/security/notices/USN-7111-1Advisory
security-tracker.debian.org/tracker/CVE-2023-45290Advisory
security.alpinelinux.org/vuln/CVE-2023-45290Advisory