CVE-2023-45290
MediumSummary
When parsing a multipart form in Go, limits on the total form size were not applied to memory consumed while reading a single form line. This allows an attacker to send a malicious request causing excessive memory consumption.
Risk Assessment
The organization is at risk of a denial-of-service (DoS) attack via memory exhaustion, potentially leading to application unavailability.
Recommendation
Immediately update the Go library to a patched version (e.g., 1.21.5 or 1.20.12) and apply memory limits for multipart forms.
Original NVD description (English source)
When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a mal