CVE-2025-58186 — Standard Library NET Http vulnerability
9 documents8 sources
Severity
5.3MEDIUMNVD
EPSS
0.0%
top 88.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedOct 29
Latest updateOct 30
Description
Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as "a=;", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4
Affected Packages1 packages
🔴Vulnerability Details
4GHSAâ–¶
GHSA-rjcg-56ph-3qvg: Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit↗2025-10-30
OSVâ–¶
CVE-2025-58186: Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit↗2025-10-29
📋Vendor Advisories
3💬Community
1Bugzillaâ–¶
CVE-2025-58186 golang.org/net/http: Lack of limit when parsing cookies can cause memory exhaustion in net/http↗2025-10-29