{"id":"CVE-2025-58186","sourceIdentifier":"security@golang.org","published":"2025-10-29T23:16:19.547","lastModified":"2026-10-11T20:10:00.200","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as \"a=;\", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption."},{"lang":"es","value":"A pesar de que los encabezados HTTP tienen un límite predeterminado de 1MB, el número de cookies que se pueden analizar no tiene un límite. Al enviar una gran cantidad de cookies muy pequeñas, como 'a=;', un atacante puede hacer que un servidor HTTP asigne una gran cantidad de estructuras, lo que provoca un gran consumo de memoria."}],"affected":[{"source":"security@golang.org","affectedData":[{"vendor":"Go standard library","product":"net/http","defaultStatus":"unaffected","collectionURL":"https://pkg.go.dev","packageName":"net/http","programRoutines":[{"name":"ParseCookie"},{"name":"readSetCookies"},{"name":"readCookies"},{"name":"Client.Do"},{"name":"Client.Get"},{"name":"Client.Head"},{"name":"Client.Post"},{"name":"Client.PostForm"},{"name":"Get"},{"name":"Head"},{"name":"Post"},{"name":"PostForm"},{"name":"Request.Cookie"},{"name":"Request.Cookies"},{"name":"Request.CookiesNamed"},{"name":"Response.Cookies"}],"versions":[{"version":"0","lessThan":"1.24.8","versionType":"semver","status":"affected"},{"version":"1.25.0","lessThan":"1.25.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-10-30T14:24:44.763207Z","id":"CVE-2025-58186","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"references":[{"url":"https://go.dev/cl/709855","source":"security@golang.org"},{"url":"https://go.dev/issue/75672","source":"security@golang.org"},{"url":"https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","source":"security@golang.org"},{"url":"https://pkg.go.dev/vuln/GO-2025-4012","source":"security@golang.org"},{"url":"http://www.openwall.com/lists/oss-security/2025/10/08/1","source":"af854a3a-2127-422b-91ae-364da2661108"}]}