Go net/http Cookie Parsing Limit Vulnerability Causes Memory Exhaustion

A vulnerability in the Go programming language's net/http package allows for memory exhaustion due to an unbounded number of cookies that can be parsed. While HTTP headers have a default size limit of 1MB, there was no limit on the number of cookies, enabling attackers to send numerous small cookies, such as 'a=;', to cause excessive memory consumption on the server.

Impact

Exploitation of this vulnerability leads to significant memory consumption on the server, potentially causing memory exhaustion issues.

Remediation

This vulnerability has been addressed in Go versions 1.25.2 and 1.24.8. Users can download these versions from the Go website or compile from source using Git. Instructions for updating to the patched versions are available in the release notes.