The net/url package in Go standard library version 1.25.0 does not enforce limits on the number of unique query parameters parsed by net/http.Request.ParseForm. This allows an attacker to craft HTTP requests with a massive number of unique query parameters, causing excessive memory allocation and consumption. The result is a denial of service condition due to application crash or unresponsiveness. The vulnerability is tracked as CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). Red Hat's advisory confirms the issue and rates it as important (high severity) with a CVSS v3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No practical mitigation other than updating the package is currently available.

Exploitation of this vulnerability results in denial of service through excessive memory consumption when parsing a large number of unique query parameters in HTTP requests. There is no impact on confidentiality or integrity. The application may crash or become unresponsive, affecting availability.

Red Hat advises updating the affected net/url package as soon as possible. No practical mitigation or workaround has been identified. Users should apply vendor patches when available to remediate this issue.