The net/http packages Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given maxMemory limit. It was possible for an attacker to generate a multipart request crafted such that the server ran out of file descriptors.
Weakness
This entry has been deprecated because it was a duplicate of CWE-774. All content has been transferred to CWE-774.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Go | Golang | * | 1.6.4 (excluding) |
| Go | Golang | 1.7 (including) | 1.7.4 (excluding) |
| Red Hat Enterprise Linux 7 | RedHat | golang-0:1.8.3-1.el7 | * |
| Golang | Ubuntu | trusty | * |
| Golang | Ubuntu | vivid/ubuntu-core | * |
| Golang-1.6 | Ubuntu | esm-infra/xenial | * |
| Golang-1.6 | Ubuntu | trusty | * |
| Golang-1.6 | Ubuntu | upstream | * |
| Golang-1.6 | Ubuntu | xenial | * |
| Golang-1.7 | Ubuntu | upstream | * |
| Golang-1.7 | Ubuntu | zesty | * |
| Golang-1.8 | Ubuntu | zesty | * |