CVE-2025-58186

Description

Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as "a=;", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption.

CVSS Metrics

• v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS Trends

Current EPSS score: 0.53%• Percentile: 44%

Affected Systems

• chainguard•age

  < 1.2.1-r8

• chainguard•age-fips

  < 1.2.1-r8

• chainguard•amass

  < 5.0.1-r1

• chainguard•amazon-k8s-cni-fips

  < 1.20.4-r2

• chainguard•amazon-k8s-cni-init-fips

  < 1.20.4-r2

• chainguard•amazon-k8s-cni-init-fips-compat

  < 1.20.4-r2

• chainguard•ansible-operator

  < 1.41.0-r1

• chainguard•ansible-operator-compat

  < 1.41.0-r1

• chainguard•apisix-ingress-controller

  < 1.8.4-r4

• chainguard•apisix-ingress-controller-compat

  < 1.8.4-r4

• chainguard•apisix-ingress-controller-iamguarded-compat

  < 1.8.4-r4

• chainguard•apm-server-7.17

  < 7.17.29-r4

• chainguard•apm-server-7.17-compat

  < 7.17.29-r4

• chainguard•apm-server-8.17

  < 8.17.10-r2

• chainguard•apm-server-8.17-compat

  < 8.17.10-r2

• chainguard•apm-server-8.18

  < 8.18.8-r1

• chainguard•apm-server-8.18-compat

  < 8.18.8-r1

• chainguard•apm-server-fips-7.17

  < 7.17.29-r4

• chainguard•apm-server-fips-7.17-compat

  < 7.17.29-r4

• chainguard•apm-server-fips-8.17

  < 8.17.10-r1

• chainguard•apm-server-fips-8.17-compat

  < 8.17.10-r1

• chainguard•apm-server-fips-8.18

  < 8.18.8-r1

• chainguard•apm-server-fips-8.18-compat

  < 8.18.8-r1

• chainguard•apm-server-fips-9.0

  < 9.0.8-r1

• chainguard•apm-server-fips-9.0-compat

  < 9.0.8-r1

• chainguard•argo-cd-2.13-compat

  < 2.13.9-r2

• chainguard•argo-rollouts

  < 1.8.3-r4

• chainguard•argo-rollouts-fips

  < 1.8.3-r5

• chainguard•atlantis

  < 0.36.0-r2

• chainguard•auditbeat-fips-8.17

  < 8.17.10-r2

• chainguard•auditbeat-fips-8.18

  < 8.18.8-r2

• chainguard•auditbeat-fips-9.0

  < 9.0.8-r2

• chainguard•authservice-fips

  < 1.1.1-r1

• chainguard•authservice-fips-compat

  < 1.1.1-r1

• chainguard•aws-iam-authenticator

  < 0.7.8-r1

• chainguard•aws-iam-authenticator-fips

  < 0.7.8-r1

• chainguard•aws-node-termination-handler

  < 1.25.2-r2

• chainguard•aws-node-termination-handler-compat

  < 1.25.2-r2

• chainguard•aws-node-termination-handler-fips

  < 1.25.2-r2

• chainguard•aws-node-termination-handler-fips-compat

  < 1.25.2-r2

• chainguard•aws-privateca-issuer-compat-fips

  < 1.7.0-r3

• chainguard•aws-privateca-issuer-fips

  < 1.7.0-r3

• chainguard•aws-s3-controller

  < 1.1.1-r1

• chainguard•aws-signer-notation-plugin

  < 1.0.2292-r3

• chainguard•aws-signer-notation-plugin-fips

  < 1.0.2292-r3

• chainguard•aws-sigv4-proxy

  < 1.10-r3

• chainguard•aws-sigv4-proxy-compat

  < 1.10-r3

• chainguard•aws-sigv4-proxy-fips

  < 1.10-r3

• chainguard•aws-sigv4-proxy-fips-compat

  < 1.10-r3

• chainguard•azure-aad-pod-identity-mic

  < 1.8.17-r28

Showing first 50 affected entries in server-rendered view.

References (6)

• https://go.dev/issue/75672
• https://go.dev/cl/709855
• https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI
• https://pkg.go.dev/vuln/GO-2025-4012
• http://www.openwall.com/lists/oss-security/2025/10/08/1
• https://security-tracker.debian.org/tracker/CVE-2025-58186