MGASA-2017-0019
Updated golang package fixes security vulnerability
The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "maxMemory" limit. It was possible for an attacker to generate a multipart request crafted such that the server ran out of file descriptors.
What each source reports
OSV No score
Updated golang package fixes security vulnerability
The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "maxMemory" limit. It was possible for an attacker to generate a multipart request crafted such that the server ran out of file descriptors.
- Record
MGASA-2017-0019- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
golangMageia:5 |
before 1.6.4-1.mga5 | 1.6.4-1.mga5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
MGASA-2017-0019 is a vulnerability with no CVSS score yet in golang, published January 14, 2017. No source lists public exploit code. Fixed in golang 1.6.4-1.mga5.