Threats tagged 'bit-golang-2025-58186'

A vulnerability in Golang's net/http package allows an attacker to cause memory exhaustion by sending a large number of very small cookies. Although HTTP headers have a default size limit of 1MB, there is no limit on the number of cookies parsed, which can lead to excessive memory allocation on the server. This issue affects versions prior to 1.24.8 and versions from 1.25.0 up to but not including 1.25.2. Fixed versions 1.24.8 and 1.25.2 address this problem.