CVE-2017-1000098 Denial of service in n/a
An attacker can cause a denial of service by exhausting file descriptors via crafted multipart requests in the Go net/http package.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-1000098?
CVE-2017-1000098 is a high-severity denial of service vulnerability in Golang Go, published on 4 Oct 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "maxMemory" limit. It was possible for an attacker to generate a multipart request crafted such that the server ran out of file descriptors.
Weakness: CWE-769
Which versions are affected by CVE-2017-1000098?
1 open source package ship an affected version, including stdlib. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
stdlib Go | All versions | 1.6.4, 1.7.4 |
Products include Golang Go.
How do I fix CVE-2017-1000098?
Upgrade stdlib to a fixed version for your release line: 1.6.4 or 1.7.4.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2017-1000098 being exploited?
There is no known exploitation of CVE-2017-1000098 in the wild and no public exploit code.
Other vulnerabilities in Golang Go
- CVE-2020-0601 Microsoft Windows CryptoAPI Spoofing
- CVE-2026-27143 Missing bound checks can lead to memory corruption in safe Go in cmd/compile
- CVE-2024-24790 Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip
- CVE-2023-39320 Arbitrary code execution via go.mod toolchain directive in cmd/go
- CVE-2023-24540 Improper handling of JavaScript whitespace in html/template
Sources
Also known as AZL-79016, AZL-98952, DLA-1123-1, GHSA-fw93-hqg3-9vw4, GO-2021-0172, UBUNTU-CVE-2017-1000098.