7.5
HIGH CVSS 3.1
CVE-2023-24536
Excessive resource consumption in net/http, net/textproto and mime/multipart
Description

Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the total memory a parsed multipart form can consume. ReadForm can undercount the amount of memory consumed, leading it to accept larger inputs than intended. 2. Limiting total memory does not account for increased pressure on the garbage collector from large numbers of small allocations in forms with many parts. 3. ReadForm can allocate a large number of short-lived buffers, further increasing pressure on the garbage collector. The combination of these factors can permit an attacker to cause an program that parses multipart forms to consume large amounts of CPU and memory, potentially resulting in a denial of service. This affects programs that use mime/multipart.Reader.ReadForm, as well as form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. With fix, ReadForm now does a better job of estimating the memory consumption of parsed forms, and performs many fewer short-lived allocations. In addition, the fixed mime/multipart.Reader imposes the following limits on the size of parsed forms: 1. Forms parsed with ReadForm may contain no more than 1000 parts. This limit may be adjusted with the environment variable GODEBUG=multipartmaxparts=. 2. Form parts parsed with NextPart and NextRawPart may contain no more than 10,000 header fields. In addition, forms parsed with ReadForm may contain no more than 10,000 header fields across all parts. This limit may be adjusted with the environment variable GODEBUG=multipartmaxheaders=.

INFO

Published Date :

April 6, 2023, 4:15 p.m.

Last Modified :

Feb. 12, 2025, 6:15 p.m.

Remotely Exploit :

Yes !
Affected Products

The following products are affected by CVE-2023-24536 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Golang go
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 HIGH [email protected]
CVSS 3.1 HIGH 134c704f-9b21-4f2e-91b3-4a467353bcc0
Solution
Update Go and related packages to mitigate a denial-of-service vulnerability.
  • Upgrade to Golang Go version 1.19.8, 1.20.3, or later.
  • Update affected packages via your system's package manager.
Public PoC/Exploit Available at Github

CVE-2023-24536 has a 3 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2023-24536 is associated with the following CWEs:

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

A powerful Kubernetes debugging tool that enables network capture, command execution, and file operations across multiple pods and nodes simultaneously through privileged debug pods.

Shell

Updated: 20 hours, 45 minutes ago
0 stars 0 fork 0 watcher
Born at : Sept. 11, 2025, 9:46 a.m. This repo has been linked 142 different CVEs too.

None

Updated: 1 year ago
0 stars 0 fork 0 watcher
Born at : July 5, 2024, 2:18 p.m. This repo has been linked 41 different CVEs too.

All Public RunWhen Helm Charts - Managed by terraform

Smarty Shell Dockerfile

Updated: 4 days, 9 hours ago
1 stars 0 fork 0 watcher
Born at : Sept. 18, 2023, 10:09 a.m. This repo has been linked 57 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2023-24536 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2023-24536 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Feb. 12, 2025

    Action Type Old Value New Value
    Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    Added CWE CWE-770
  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 21, 2024

    Action Type Old Value New Value
    Added Reference https://go.dev/cl/482075
    Added Reference https://go.dev/cl/482076
    Added Reference https://go.dev/cl/482077
    Added Reference https://go.dev/issue/59153
    Added Reference https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8
    Added Reference https://pkg.go.dev/vuln/GO-2023-1705
    Added Reference https://security.gentoo.org/glsa/202311-09
    Added Reference https://security.netapp.com/advisory/ntap-20230526-0007/
  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • CVE Modified by [email protected]

    Nov. 25, 2023

    Action Type Old Value New Value
    Added Reference Go Project https://security.gentoo.org/glsa/202311-09 [No types assigned]
  • CVE Modified by [email protected]

    Nov. 07, 2023

    Action Type Old Value New Value
    Removed CWE Go Project CWE-400
  • CVE Modified by [email protected]

    May. 26, 2023

    Action Type Old Value New Value
    Added Reference https://security.netapp.com/advisory/ntap-20230526-0007/ [No Types Assigned]
  • Initial Analysis by [email protected]

    Apr. 17, 2023

    Action Type Old Value New Value
    Added CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    Changed Reference Type https://go.dev/cl/482075 No Types Assigned https://go.dev/cl/482075 Patch
    Changed Reference Type https://go.dev/cl/482076 No Types Assigned https://go.dev/cl/482076 Patch
    Changed Reference Type https://go.dev/cl/482077 No Types Assigned https://go.dev/cl/482077 Patch
    Changed Reference Type https://go.dev/issue/59153 No Types Assigned https://go.dev/issue/59153 Issue Tracking, Patch
    Changed Reference Type https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8 No Types Assigned https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8 Mailing List
    Changed Reference Type https://pkg.go.dev/vuln/GO-2023-1705 No Types Assigned https://pkg.go.dev/vuln/GO-2023-1705 Vendor Advisory
    Added CWE NIST CWE-770
    Added CPE Configuration OR *cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* versions up to (excluding) 1.19.8 *cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* versions from (including) 1.20.0 up to (excluding) 1.20.3
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
Vulnerability Scoring Details
Base CVSS Score: 7.5
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact
Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

0.07 }} 0.01%

score

0.20598

percentile