Уязвимость в обработке multipart форм, позволяющая исчерпание ресурсов CPU и памяти и приводящая к DoS атаке
Описание
Обнаружена уязвимость в обработке multipart форм в Go, которая может привести к чрезмерному использованию ресурсов CPU и памяти при обработке форм с большим количеством частей. Это затрагивает функции mime/multipart.Reader.ReadForm и методы обработки форм в пакете net/http, такие как FormFile, FormValue, ParseMultipartForm и другие.
Причины уязвимости
- Некорректный подсчёт памяти:
ReadFormнедооценивает объём потребляемой памяти, что позволяет обработать больше данных, чем предусмотрено ограничением. - Нагрузка на сборщик мусора: Большое количество небольших аллокаций в формах с множеством частей увеличивает нагрузку на сборщик мусора.
- Кратковременные буферы:
ReadFormвыделяет множество кратковременных буферов, что дополнительно увеличивает нагрузку.
Последствия
Эта комбинация факторов позволяет злоумышленнику вызвать чрезмерное потребление CPU и памяти, что может привести к отказу в обслуживании (Denial of Service, DoS).
Ссылки
- Patch
- Patch
- Patch
- Issue TrackingPatch
- Mailing List
- Vendor Advisory
- Patch
- Patch
- Patch
- Issue TrackingPatch
- Mailing List
- Vendor Advisory
Уязвимые конфигурации
Одно из
EPSS
7.5 High
CVSS3
Дефекты
Связанные уязвимости
Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the total memory a parsed multipart form can consume. ReadForm can undercount the amount of memory consumed, leading it to accept larger inputs than intended. 2. Limiting total memory does not account for increased pressure on the garbage collector from large numbers of small allocations in forms with many parts. 3. ReadForm can allocate a large number of short-lived buffers, further increasing pressure on the garbage collector. The combination of these factors can permit an attacker to cause an program that parses multipart forms to consume large amounts of CPU and memory, potentially resulting in a denial of service. This affects programs that use mime/multipart.Reader.ReadForm, as well as form parsing in the net/http package with the Request methods FormFile, FormValue, Parse...
Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the total memory a parsed multipart form can consume. ReadForm can undercount the amount of memory consumed, leading it to accept larger inputs than intended. 2. Limiting total memory does not account for increased pressure on the garbage collector from large numbers of small allocations in forms with many parts. 3. ReadForm can allocate a large number of short-lived buffers, further increasing pressure on the garbage collector. The combination of these factors can permit an attacker to cause an program that parses multipart forms to consume large amounts of CPU and memory, potentially resulting in a denial of service. This affects programs that use mime/multipart.Reader.ReadForm, as well as form parsing in the net/http package with the Request methods FormFile, FormValue, Parse...
Multipart form parsing can consume large amounts of CPU and memory whe ...
Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the total memory a parsed multipart form can consume. ReadForm can undercount the amount of memory consumed, leading it to accept larger inputs than intended. 2. Limiting total memory does not account for increased pressure on the garbage collector from large numbers of small allocations in forms with many parts. 3. ReadForm can allocate a large number of short-lived buffers, further increasing pressure on the garbage collector. The combination of these factors can permit an attacker to cause an program that parses multipart forms to consume large amounts of CPU and memory, potentially resulting in a denial of service. This affects programs that use mime/multipart.Reader.ReadForm, as well as form parsing in the net/http package with the Request methods FormFile, FormValue, Parse...
Уязвимость пакетов mime/multipart, net/textproto языка программирования Golang, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
7.5 High
CVSS3