Evidence used
- No CISA KEV confirmation is currently recorded.
- The selected CVSS metric records a network-reachable, unauthenticated path with no user interaction.
- EPSS is 1.48% for the current model date.
BlackTreeCVE IntelligenceFull vulnerability report · 2023
CVE-2023-24536High confidence
Excessive resource consumption in net/http, net/textproto and mime/multipart
Go standard library · mime/multipart
7.5HighCVSS 3.1
Within 7 days
Patch availableHigh technical severity; prioritise exposed affected systems while verifying vendor guidance.
R
Open reassessment dashboard →Operational reassessment
Published severity in operational context
Published severityHigh→Operational priority:High, unchanged from published severity.unchanged
Compensating controls
- Validate the affected product branch and deploy the verified fixed release.
- Restrict the affected network interface to trusted sources where business-safe.
- Monitor vendor guidance and exploitation sources for a material change.
Verification
- Confirm that the asset runs Go standard library mime/multipart and falls inside the recorded affected range.
- Verify the installed build against the product-specific fixed version after deployment.
- Validate exposure, authentication requirements and compensating controls in the actual environment.
- Reopen this reassessment when CVSS, KEV, EPSS, exploit evidence or remediation changes.
Distribution package intelligence
4 package statesRelease-specific package status
Alpine, Debian findings are scoped to the named distribution, release and source package. An absent finding does not mean a package is unaffected.
Repository candidate not checked
A published vendor fix does not prove that a matching update is enabled and installable on a particular asset. Confirm the local package candidate before scheduling remediation.
| Distribution release | Source package | Vendor state | Fixed version | Evidence |
|---|---|---|---|---|
| Alpine v3.23v3.23 · community | go | Vendor fix publishedAlpine records a security fix at this version. An absent entry does not mean the package is unaffected. | 1.20.3-r0 | Alpine Security Database ↗Source updated 11 Sep 2026 |
| Alpine v3.22v3.22 · community | go | Vendor fix publishedAlpine records a security fix at this version. An absent entry does not mean the package is unaffected. | 1.20.3-r0 | Alpine Security Database ↗Source updated 11 Sep 2026 |
| Alpine v3.21v3.21 · community | go | Vendor fix publishedAlpine records a security fix at this version. An absent entry does not mean the package is unaffected. | 1.20.3-r0 | Alpine Security Database ↗Source updated 19 Aug 2026 |
| Debian bookwormbookworm · source | golang-1.19 | Vendor fix publishedDebian records a fixed source-package version for this release. | 1.19.8-2 | Debian Security Tracker ↗Source updated 5 Oct 2026 |
Direct vendor intelligence
1 currentAuthoritative vendor CSAF and VEX advisories
Structured product status and remediation from the issuing vendor. Product-state explanations are always visible; large lists can be searched or downloaded.
CVE-2023-24536 · CSAF 2.0 · revision 3 · finalRed Hat Product Securitygolang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption
The vendor explicitly identifies these products as affected by this CVE.
- workload-availability/node-healthcheck-rhel8-operator as a component of Node HealthCheck Operator
- workload-availability/node-maintenance-rhel8-operator as a component of Node Maintenance Operator
- helm.src as a component of OpenShift Developer Tools and Services
- ocp-tools-4/jenkins-rhel8 as a component of OpenShift Developer Tools and Services
- odo.src as a component of OpenShift Developer Tools and Services
- openshift-pipelines-client.src as a component of OpenShift Pipelines
- openshift-golang-builder-container as a component of OpenShift Service Mesh 2
- 3scale-operator-container as a component of Red Hat 3scale API Management Platform 2
- thanos-contain.src as a component of Red Hat Advanced Cluster Management for Kubernetes 2
- advanced-cluster-security/rhacs-main-rhel8 as a component of Red Hat Advanced Cluster Security 3
- amq-broker-rhel8-operator-container as a component of Red Hat AMQ Broker 7
- receptor.src as a component of Red Hat Ansible Automation Platform 2
- Summary
- A flaw was found in Golang Go, where it is vulnerable to a denial of service caused by an issue during multipart form parsing. By sending a specially crafted input, a remote attacker can consume large amounts of CPU and memory, resulting in a denial of service.
- Remediation
- Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
High technical severity; prioritise exposed affected systems while verifying vendor guidance.
Patch available01
What, why and how
Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the total memory a parsed multipart form can consume. ReadForm can undercount the amount of memory consumed, leading it to accept larger inputs than intended. 2. Limiting total memory does not account for increased pressure on the garbage collector from large numbers of small allocations in forms with many parts. 3. ReadForm can allocate a large number of short-lived buffers, further increasing pressure on the garbage collector. The combination of these factors can permit an attacker to cause an program that parses multipart forms to consume large amounts of CPU and memory, potentially resulting in a denial of service. This affects programs that use mime/multipart.Reader.ReadForm, as well as form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. With fix, ReadForm now does a better job of estimating the memory consumption of parsed forms, and performs many fewer short-lived allocations. In addition, the fixed mime/multipart.Reader imposes the following limits on the size of parsed forms: 1. Forms parsed with ReadForm may contain no more than 1000 parts. This limit may be adjusted with the environment variable GODEBUG=multipartmaxparts=. 2. Form parts parsed with NextPart and NextRawPart may contain no more than 10,000 header fields. In addition, forms parsed with ReadForm may contain no more than 10,000 header fields across all parts. This limit may be adjusted with the environment variable GODEBUG=multipartmaxheaders=.
What
Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the total memory a parsed multipart form can consume. ReadForm can undercount the amount of memory consumed, leading it to accept larger inputs than intended. 2. Limiting total memory does not account for increased pressure on the garbage collector from large numbers of small allocations in forms with many parts. 3. ReadForm can allocate a large number of short-lived buffers, further increasing pressure on the garbage collector. The combination of these factors can permit an attacker to cause an program that parses multipart forms to consume large amounts of CPU and memory, potentially resulting in a denial of service. This affects programs that use mime/multipart.Reader.ReadForm, as well as form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. With fix, ReadForm now does a better job of estimating the memory consumption of parsed forms, and performs many fewer short-lived allocations. In addition, the fixed mime/multipart.Reader imposes the following limits on the size of parsed forms: 1. Forms parsed with ReadForm may contain no more than 1000 parts. This limit may be adjusted with the environment variable GODEBUG=multipartmaxparts=. 2. Form parts parsed with NextPart and NextRawPart may contain no more than 10,000 header fields. In addition, forms parsed with ReadForm may contain no more than 10,000 header fields across all parts. This limit may be adjusted with the environment variable GODEBUG=multipartmaxheaders=.
Why
The product does not properly control the allocation and maintenance of a limited resource.
How
An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may disrupt the affected service.
What
Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the total memory a parsed multipart form can consume. ReadForm can undercount the amount of memory consumed, leading it to accept larger inputs than intended. 2. Limiting total memory does not account for increased pressure on the garbage collector from large numbers of small allocations in forms with many parts. 3. ReadForm can allocate a large number of short-lived buffers, further increasing pressure on the garbage collector. The combination of these factors can permit an attacker to cause an program that parses multipart forms to consume large amounts of CPU and memory, potentially resulting in a denial of service. This affects programs that use mime/multipart.Reader.ReadForm, as well as form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. With fix, ReadForm now does a better job of estimating the memory consumption of parsed forms, and performs many fewer short-lived allocations. In addition, the fixed mime/multipart.Reader imposes the following limits on the size of parsed forms: 1. Forms parsed with ReadForm may contain no more than 1000 parts. This limit may be adjusted with the environment variable GODEBUG=multipartmaxparts=. 2. Form parts parsed with NextPart and NextRawPart may contain no more than 10,000 header fields. In addition, forms parsed with ReadForm may contain no more than 10,000 header fields across all parts. This limit may be adjusted with the environment variable GODEBUG=multipartmaxheaders=.
Why
The product does not properly control the allocation and maintenance of a limited resource.
How
An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may disrupt the affected service.
02
Exploit reality and attack path
CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.
Observed exploitation No confirmed evidence
?
Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.No CISA KEV match was present at the last successful refresh. This means no confirmation from that source, not proof of no exploitation.
Public PoC / exploit material None recorded
?
Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.No exploit-tagged reference or CISA SSVC proof-of-concept state is currently recorded. Research may still exist outside the structured feeds.
- Likely attack path
- a network path → Uncontrolled Resource Consumption → disrupt the affected service
- Attack surface
- Network
- Privileges required
- None: unauthenticated exploitation is possible
- User interaction
- None
- Attack complexity
- Low: no specialised conditions are recorded
- Security boundary
- Unchanged: impact remains within the vulnerable component's security authority
- Weakness
?
CWE means Common Weakness Enumeration: a standard category for the underlying weakness. - CWE-400 ↗
CWE-400: Uncontrolled Resource Consumption. The product does not properly control the allocation and maintenance of a limited resource.
- CVSS vector
?
CVSS means Common Vulnerability Scoring System. The vector records the metric values used to calculate technical severity. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCommon Vulnerability Scoring System 3.1: the compact vector below is decoded into plain language.
AVNetworkAttack vector: The vulnerable component can be reached over a network.ACLowAttack complexity: No specialised conditions are required beyond attacker-controlled input.PRNonePrivileges required: The attacker does not need an account or existing privileges.UINoneUser interaction: No action by another user is required.SUnchangedScope: The security impact remains within the vulnerable component's authority.CNoneConfidentiality impact: No direct loss is represented by this metric.INoneIntegrity impact: No direct loss is represented by this metric.AHighAvailability impact: A successful attack can cause a major loss.- Post-exploitation / living off the land
- No specific living-off-the-land technique is confirmed in the structured sources. Monitor normal administration tools for activity inconsistent with the affected service's baseline.
03
Patch and workaround
Operational remediation based on structured source evidence.
- Status
?
Patch availability is based on structured fixed-version fields and authoritative update references. If no fix is verified, check the vendor advisory before making a change. - Patch available
- Affected
- workload-availability/node-healthcheck-rhel8-operator as a component of Node HealthCheck Operator
- workload-availability/node-maintenance-rhel8-operator as a component of Node Maintenance Operator
- helm.src as a component of OpenShift Developer Tools and Services
- ocp-tools-4/jenkins-rhel8 as a component of OpenShift Developer Tools and Services
- odo.src as a component of OpenShift Developer Tools and Services
- openshift-pipelines-client.src as a component of OpenShift Pipelines
- openshift-golang-builder-container as a component of OpenShift Service Mesh 2
- 3scale-operator-container as a component of Red Hat 3scale API Management Platform 2
- thanos-contain.src as a component of Red Hat Advanced Cluster Management for Kubernetes 2
- advanced-cluster-security/rhacs-main-rhel8 as a component of Red Hat Advanced Cluster Security 3
- amq-broker-rhel8-operator-container as a component of Red Hat AMQ Broker 7
- receptor.src as a component of Red Hat Ansible Automation Platform 2
- skupper-cli.src as a component of Red Hat Application Interconnect 1.0
- golang-bin as a component of Red Hat Ceph Storage 3
- golang-src as a component of Red Hat Ceph Storage 3
- golang.src as a component of Red Hat Ceph Storage 3
- rhceph/rhceph-5-dashboard-rhel8 as a component of Red Hat Ceph Storage 5
- buildah-tests (container-tools:3.0) as a component of Red Hat Enterprise Linux 8
- buildah.src (container-tools:3.0) as a component of Red Hat Enterprise Linux 8
- buildah (container-tools:3.0) as a component of Red Hat Enterprise Linux 8
- containernetworking-plugins.src (container-tools:3.0) as a component of Red Hat Enterprise Linux 8
- containernetworking-plugins (container-tools:3.0) as a component of Red Hat Enterprise Linux 8
- containers-common (container-tools:3.0) as a component of Red Hat Enterprise Linux 8
- git-lfs as a component of Red Hat Enterprise Linux 8
- git-lfs.src as a component of Red Hat Enterprise Linux 8
- osbuild-composer as a component of Red Hat Enterprise Linux 8
- osbuild-composer-core as a component of Red Hat Enterprise Linux 8
- osbuild-composer-dnf-json as a component of Red Hat Enterprise Linux 8
- osbuild-composer-worker as a component of Red Hat Enterprise Linux 8
- osbuild-composer.src as a component of Red Hat Enterprise Linux 8
- and 71 more
- Fixed
- openshift-clients-0:4.12.0-202307200611.p0.g49844f7.assembly.stream.el8.src as a component of Red Hat Ansible Automation Platform 2.3 for RHEL 8
- openshift-clients-0:4.12.0-202307200611.p0.g49844f7.assembly.stream.el8.x86_64 as a component of Red Hat Ansible Automation Platform 2.3 for RHEL 8
- cryostat-tech-preview/cryostat-grafana-dashboard-rhel8@sha256:c0bd96a3e451ee82a5874e56b34156050452ff7fbafaf192b5991b825e6dd979_amd64 as a component of Cryostat 2 on RHEL 8
- cryostat-tech-preview/cryostat-operator-bundle@sha256:d5dc8178232bc360954311bfc28fbbf0ead2144a73b289b0308f27d9c3379b60_amd64 as a component of Cryostat 2 on RHEL 8
- cryostat-tech-preview/cryostat-reports-rhel8@sha256:21c64326fda1bf605b430844634fd456f3ebbafd7539c18356ee0ceb204f614f_amd64 as a component of Cryostat 2 on RHEL 8
- cryostat-tech-preview/cryostat-rhel8-operator@sha256:91b3cf3508eff9ebc86b40aed0e9216caf2120d68ce2dfa178094733153b467c_amd64 as a component of Cryostat 2 on RHEL 8
- cryostat-tech-preview/cryostat-rhel8@sha256:e207cee8c61092f6c8e75b3a4aea220d248ec24169da45864c948a966d686f81_amd64 as a component of Cryostat 2 on RHEL 8
- cryostat-tech-preview/jfr-datasource-rhel8@sha256:5156043fce0f9130235c7cf9cdb19545620524dac856f6638dff72735647206f_amd64 as a component of Cryostat 2 on RHEL 8
- oadp/oadp-velero-rhel8@sha256:43c1b134f68e4b71f3a1a35769fb573a9c496ffc5ba188b13b97a52ee2ab8479_amd64 as a component of 8Base-OADP-1.1
- oadp/oadp-velero-rhel8@sha256:b4ab733bfbf853bbac246530f1b4b0dafae2173ab93e32d1cebdd5b6c70dae29_ppc64le as a component of 8Base-OADP-1.1
- oadp/oadp-velero-rhel8@sha256:e583bed08cbd7e36f0f7a66bd18c41b62d4062fdb5d43ec8e191d37ecf23be11_s390x as a component of 8Base-OADP-1.1
- openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8@sha256:5804495067018a355d02f88d2324a43567f0ca2869d02dedbf47973ed6ffeeb3_amd64 as a component of OSSO 1.1 for RHEL 8
- openshift-serverless-clients-0:1.8.1-3.el8.ppc64le as a component of Red Hat OpenShift Serverless 1.0
- openshift-serverless-clients-0:1.8.1-3.el8.s390x as a component of Red Hat OpenShift Serverless 1.0
- openshift-serverless-clients-0:1.8.1-3.el8.src as a component of Red Hat OpenShift Serverless 1.0
- openshift-serverless-clients-0:1.8.1-3.el8.x86_64 as a component of Red Hat OpenShift Serverless 1.0
- quay/clair-rhel8@sha256:dcbe91b758a2db9eeb19cf34ca2c3b2f48f4e61a2f312ac13337f6cfcc2ba7c5_amd64 as a component of Quay v3
- quay/quay-bridge-operator-bundle@sha256:fde9d641d26bd97ad63b545af91a6f86e67fb252a1d9328c99b026e1a62b3c15_amd64 as a component of Quay v3
- quay/quay-bridge-operator-rhel8@sha256:1f6f955e901ca25715cdcfcb567bfabf279b4c44f0593120967c4c347806f2d1_amd64 as a component of Quay v3
- quay/quay-builder-qemu-rhcos-rhel8@sha256:8a3d0913a6b1f323f000435a85fbde56a0021051a2f57e784a17781b677a6d6c_amd64 as a component of Quay v3
- quay/quay-builder-rhel8@sha256:52d74364ad13706a09cc74e89da5610c452c54b16ebf657a8f435886c76bc697_amd64 as a component of Quay v3
- quay/quay-container-security-operator-bundle@sha256:69a28778d3dc2af9dcc2ceeeb917eaa38b0736c71f32d781f8bf7e6828852287_amd64 as a component of Quay v3
- quay/quay-container-security-operator-rhel8@sha256:af56af6433f7cebc28e3c4266c97faf99828e6716cbfad3f5d5883197e0375cd_amd64 as a component of Quay v3
- quay/quay-operator-bundle@sha256:a97a63899d23e23d039ea36bd575c018d7b6295b7942b15a8bded52f09736bda_amd64 as a component of Quay v3
- quay/quay-operator-rhel8@sha256:3db71686dc001996d28d3a1ac41b918394806e5b25f6f429705958b6042e63fd_amd64 as a component of Quay v3
- quay/quay-rhel8@sha256:1abf35ee92122d3811252ce4d31dbc17192758c42434a970cb2d374630abb0cd_amd64 as a component of Quay v3
- advanced-cluster-security/rhacs-main-rhel8@sha256:222b3ba1cf2a40cb31198091b667f351a78a65db1ed7537323c2e477c9878124_s390x as a component of RHACS 4.1 for RHEL 8
- advanced-cluster-security/rhacs-main-rhel8@sha256:378d9937f14520c62e0badb320cc755806d2a517873b12d2f9f08fb857562433_amd64 as a component of RHACS 4.1 for RHEL 8
- advanced-cluster-security/rhacs-main-rhel8@sha256:7e86701d783471db34743c44d527f55b02bb922b3bc270ce4c9f749885991730_ppc64le as a component of RHACS 4.1 for RHEL 8
- rhmtc/openshift-velero-plugin-rhel8@sha256:916d5fd70f5eb58931927d44e05e2287ce85f04ac3bdefde78b6522214a0286e_amd64 as a component of 8Base-RHMTC-1.7
- and 1628 more
- Action
- Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
- Workaround
- No verified workaround is recorded. If business-safe, reduce exposure to the affected interface and allow only trusted sources until authoritative guidance is available.
04
Evidence and provenance
Published 6 Apr 2023 · Last source change 13 Feb 2025, 16:44 UTC · CWE-400 · Uncontrolled Resource Consumption
CVE recordCVE.org · 5.1
CVSS sourceNIST NVD
EPSS source FIRST · tracked since 2026-08-14
?
The date BlackTree first stored a score for this CVE from the daily FIRST EPSS feed.European sourceENISA EUVD · EUVD-2023-28552
Product sourceVendor CSAF · Red Hat Product Security
Remediation sourceVendor CSAF · Red Hat Product Security
CWE sourceCNA
NVD statusNVD modified after enrichment
Core structured fields are present and their contributing authorities are shown above.
Material change intelligence
View recent updates ↗What changed after publication
- Affected versionsThe structured affected or fixed version information changed.Red Hat Product Security ↗
- Before
- < 1.19.8; 1.20.0-0 < 1.20.3 · Fixed: An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.
- After
- < 1.19.8; 1.20.0-0 < 1.20.3 · Fixed: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
CVE published
Fixed release or patch reference recorded
Fixed release recorded from official guidance
Fixed release recorded from official guidance
Fixed release recorded from official guidance
Fixed release recorded from official guidance
Technical terms and abbreviations used in this report
- CVE
- Common Vulnerabilities and Exposures: the public identifier for one disclosed vulnerability.
- CVSS
- Common Vulnerability Scoring System: a technical severity framework; it is not patching priority by itself.
- EPSS
- Exploit Prediction Scoring System: FIRST's estimate of the probability that exploitation activity will be observed in the next 30 days; it is a forecast, not confirmation.
- CWE
- Common Weakness Enumeration: the standard category describing the underlying software or hardware weakness.
- CNA
- CVE Numbering Authority: an organisation authorised to assign and publish CVE records.
- CISA ADP
- Cybersecurity and Infrastructure Security Agency Authorized Data Publisher: structured enrichment added to a CVE record.
- NVD
- National Vulnerability Database: NIST's enrichment service for CVE records.
- CERT / CSIRT
- A computer security incident response team that publishes warnings or coordinates incident response.
- PoC
- Proof of concept: public material that demonstrates or helps reproduce exploitation.
- CSAF
- Common Security Advisory Framework: a machine-readable format for security advisories.
- LoTL
- Living off the land: abuse of legitimate tools or system functions during an attack.