CVE-2017-1000098

The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "maxMemory" limit

published October 4, 2017

CVSS
—
EPSS
2%
Percentile
81.2
In the wild
Unconfirmed
What it is

The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "maxMemory" limit. It was possible for an attacker to generate a multipart request crafted such that the server ran out of file descriptors.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02078 · 81.2th percentile
Published
2017-10-04T01:00Z
EPSS history
Timeline
  • 04 OCT 01:00Z
    The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "maxMemory" limit
    cvelistv5