High · published January 29, 2026
⚡ Without limits, this vulnerability lets query parameters run wild! The net/url package lacks a cap on the number of parameters, leading to potential memory overload. 🔥 Think of it like a buffet with no limit on how much food you can pile on your plate. Eventually, the weight becomes too much to handle, and you might just topple over! An attacker could exploit this by sending a massive number of query parameters, causing your server to consume excessive memory and potentially crash or slow down your application. This can lead to service disruptions, affecting user experience and trust.
Think of it like a buffet with no limit on how much food you can pile on your plate. Eventually, the weight becomes too much to handle, and you might just topple over! This vulnerability arises because the net/url package does not impose a limit on the number of query parameters allowed in a URL, which can lead to memory exhaustion during the parsing of large URL-encoded forms.
An attacker could exploit this by sending a massive number of query parameters, causing your server to consume excessive memory and potentially crash or slow down your application. This can lead to service disruptions, affecting user experience and trust. To remediate this issue, review your applications using the net/url package and implement a limit on the number of query parameters processed. Additionally, consider setting a maximum size for request headers to prevent excessive memory usage. It's also a good idea to test your applications for vulnerabilities periodically. 🛡️ You've got this! With these steps, you can secure your application against this sneaky memory hog! 💪✨
| Product | Versions | Fixed in |
|---|---|---|
| golang/go | < 1.24.12 | 1.24.12 |
| golang/go | ≥ 1.25.0, < 1.25.6 | 1.25.6 |