BIT-GOLANG-2026-94440 Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes...

Updated golang packages fix security vulnerabilities

net/http: HTTP/2 server crash due to HPACK encoder race net/http: HTTP/2 server memory exhaustion due to Trailer headers crypto/tls: reject malformed ECH outer extension references cmd/go: checksum bypass for golang.org/fips140 cmd/go: checksum database bypass for golang.org/toolchain...

CVE-2026-94440

Parsing a multipart form can bypass memory limits and allow an attacker to read an arbitrarily long line into memory. This occurs specifically when the remaining limit at the start of a part is less than 400 bytes . The vulnerability is associated with CWE-770 (Allocation of Resources Without Lim...

CVE-2026-94440 Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes...

CVE-2026-94440 Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes...

GO-2026-6608 Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes...

Astra Linux – Vulnerability in Wireshark

In Wireshark versions 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the MIME Multipart dissector could crash. This issue was addressed in the epan/dissectors/packet-multipart.c file by correcting the deallocation of invalid MIME parts...

AlmaLinux 9.2 [TuxCare] Security Update: containernetworking-plugins Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1762538558)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1762538558 advisory. - A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of...

Rocky Linux 9.6 [TuxCare] Security Update: podman / podman-docker / podman-plugins / podman-remote / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1772465492)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1772465492 advisory. - Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which caus...

EUVD-2026-64953

Improper input validation vulnerability in Apache Camel. This issue affects Apache Camel: from 2.17.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-mail component ships a MimeMultipart data format that can unmarshal a MIME multipart message. When it is configured...

RockyLinux 8 : container-tools:4.0 (RLSA-2023:6938)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:6938 advisory. go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents CVE-2022-3064 golang: html/template: improper handli...

EUVD-2006-6286

Malware in sbrugna...

EUVD-2020-18496

Malware in sbrugna...

Excessive resource consumption in mime/multipart

...

Excessive resource consumption in net/http, net/textproto and mime/multipart

...

OESA-2025-1221 golang security update

. Security Fixes: HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more...

AlmaLinux 8 : container-tools:rhel8 (ALSA-2024:8038)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:8038 advisory. golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm CVE-2023-45290 go/parser: golang: Calling...

RHEL 8 / 9 : Red Hat Service Interconnect 1.4 Release (RHSA-2023:4003)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4003 advisory. As a Kubernetes user, I cannot connect easily connect services from one cluster with services on another cluster. Red Hat Application...

RHEL 8 / 9 : OpenShift Container Platform 4.13.3 (RHSA-2023:3536)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3536 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or...

Golang mime/multipart DoS

The vulnerability of the mime/multipart and net/text proto types in the Golang programming language is related to the distribution of resources without any restrictions or regulations. Exploiting this vulnerability can allow a remote attacker to cause service failures...