CVE-2017-1000098
golang: net/http: multipart ReadForm close file after copy
Severity
ModerateRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · December 1, 2016
Updated · May 13, 2026
Description
The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "maxMemory" limit. It was possible for an attacker to generate a multipart request crafted such that the server ran out of file descriptors.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.0 · 5.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 · 4.3AV:N/AC:M/Au:N/C:N/I:N/A:P
CWE not specified