MEDIUM5.3
GO-2025-4012
Lack of limit when parsing cookies can cause memory exhaustion in net/http
Quick fix
GO-2025-4012 — stdlib: upgrade to the fixed version with the command below.
go get stdlib@v1.24.8Details
Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as "a=;", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption.
Are you affected?
Enter the version of the package you're using.