Skip to content

net/http: lack of limit when parsing cookies can cause memory exhaustion (CVE-2025-58186) #75672

Closed
Closed
net/http: lack of limit when parsing cookies can cause memory exhaustion (CVE-2025-58186)#75672
Labels
FrozenDueToAgeNeedsFixThe path to resolution is known, but the work has not been done.Securityrelease-blocker
Milestone
Go1.26

Description

@nicholashusin
nicholashusin
opened on Sep 30, 2025

Despite HTTP headers having a default limit of 1 MB, the number of cookies that can be parsed did not have a limit.
By sending a lot of very small cookies such as "a=;", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption.

net/http now limits the number of cookies accepted to 3000, which can be adjusted using the httpcookiemaxnum GODEBUG option.

Thanks to jub0bs for reporting this issue.

This is CVE-2025-58186 and Go issue https://go.dev/issue/75672.

This is a PRIVATE issue for CVE-2025-58186, tracked in http://b/442560983 and fixed by https://go-internal-review.git.corp.google.com/c/go/+/2720.

/cc @golang/security and @golang/release

Activity

  1. Imagecagedmantis
    added
    NeedsFixThe path to resolution is known, but the work has not been done.
    on Sep 30, 2025
  2. Imageneild
    added
    Security
    release-blocker
    on Sep 30, 2025
  3. Imageneild
    added this to the Go1.26 milestone on Sep 30, 2025
  4. Imageneild
    removed
    NeedsFixThe path to resolution is known, but the work has not been done.
    on Sep 30, 2025

  5. neild commented on Oct 1, 2025

    @neild
    neild
    on Oct 1, 2025
    Contributor

    @gopherbot please open backport issues for this security fix

  6. gopherbot commented on Oct 1, 2025

    @gopherbot
    gopherbot
    on Oct 1, 2025
    Contributor

    Backport issue(s) opened: #75706 (for 1.24), #75707 (for 1.25).

    Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.

  7. Imagecagedmantis
    added
    NeedsFixThe path to resolution is known, but the work has not been done.
    on Oct 2, 2025

  8. gopherbot commented on Oct 7, 2025

    @gopherbot
    gopherbot
    on Oct 7, 2025
    Contributor

    Change https://go.dev/cl/709840 mentions this issue: [release-branch.go1.24] net/http: add httpcookiemaxnum GODEBUG option to limit number of cookies parsed

  9. gopherbot commented on Oct 7, 2025

    @gopherbot
    gopherbot
    on Oct 7, 2025
    Contributor

    Change https://go.dev/cl/709849 mentions this issue: [release-branch.go1.25] net/http: add httpcookiemaxnum GODEBUG option to limit number of cookies parsed

  10. gopherbot commented on Oct 7, 2025

    @gopherbot
    gopherbot
    on Oct 7, 2025
    Contributor

    Change https://go.dev/cl/709855 mentions this issue: net/http: add httpcookiemaxnum GODEBUG option to limit number of cookies parsed

  11. Imagegopherbot
    added 3 commits that reference this issue on Oct 7, 2025

    [release-branch.go1.24] net/http: add httpcookiemaxnum GODEBUG option…

    c6b04dd

    [release-branch.go1.25] net/http: add httpcookiemaxnum GODEBUG option…

    100c5a6

    net/http: add httpcookiemaxnum GODEBUG option to limit number of cook…

    9b9d02c
  12. Imageprattmic
    changed the title [-]security: fix CVE-2025-58186[/-] [+]net/http: lack of limit when parsing cookies can cause memory exhaustion (CVE-2025-58186)[/+] on Oct 7, 2025
  13. Imageprattmic
    closed this as completedon Oct 8, 2025
  14. Imagerickystewart
    added 2 commits that reference this issue on Oct 8, 2025

    [release-branch.go1.24] net/http: add httpcookiemaxnum GODEBUG option…

    94ab5cf

    [release-branch.go1.24] net/http: add httpcookiemaxnum GODEBUG option…

    7422bfb
  15. Imagelxq015
    added a commit that references this issue on Dec 10, 2025

    [release-branch.go1.25] net/http: add httpcookiemaxnum GODEBUG option…

    bacd3fe
  16. Imagelxq015
    added a commit that references this issue on Mar 19, 2026

    [release-branch.go1.25] net/http: add httpcookiemaxnum GODEBUG option…

    dc76ffe
  17. Imagegolang
    locked and limited conversation to collaborators on Oct 8, 2026
  18. Imagegopherbot
    added
    FrozenDueToAge
    on Oct 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    FrozenDueToAgeNeedsFixThe path to resolution is known, but the work has not been done.Securityrelease-blocker

    Type

    No type

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions