CVE-2025-58186

A flaw was found in golang.org/net/http. A remote attacker could exploit this vulnerability by sending a large number of small cookies to an HTTP server. Despite a default 1MB limit on HTTP headers, the number of cookies parsed is unrestricted, leading to excessive memory allocation. This can cause the server to consume significant memory resources, resulting in a denial of service (DoS) for legitimate users.

A denial of service vulnerability exists in applications using golang.org/net/http where an attacker can cause excessive memory consumption by sending a large number of small cookies. While HTTP headers generally have a 1MB limit, the parsing of individual cookies does not, leading to potential resource exhaustion. This issue has a Low impact on Red Hat products due to typical deployment configurations and resource management practices.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.