{"id":"GO-2021-0172","summary":"Denial of service when parsing large forms in mime/multipart","details":"When parsing large multipart/form-data, an attacker can cause a HTTP server to open a large number of file descriptors. This may be used as a denial-of-service vector.","aliases":["CVE-2017-1000098"],"modified":"2026-03-17T04:05:49.729902Z","published":"2022-02-15T23:56:14Z","database_specific":{"url":"https://pkg.go.dev/vuln/GO-2021-0172","review_status":"REVIEWED"},"references":[{"type":"FIX","url":"https://go.dev/cl/30410"},{"type":"FIX","url":"https://go.googlesource.com/go/+/7478ea5dba7ed02ddffd91c1d17ec8141f7cf184"},{"type":"REPORT","url":"https://go.dev/issue/16296"},{"type":"WEB","url":"https://groups.google.com/g/golang-dev/c/4NdLzS8sls8/m/uIz8QlnIBQAJ"}],"affected":[{"package":{"name":"stdlib","ecosystem":"Go","purl":"pkg:golang/stdlib"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.6.4"},{"introduced":"1.7.0-0"},{"fixed":"1.7.4"}]}],"ecosystem_specific":{"imports":[{"path":"mime/multipart","symbols":["Reader.readForm"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2021-0172.json"}}],"schema_version":"1.7.5","credits":[{"name":"Simon Rawet"}]}