PT-2025-45817 · Go · Stdlib
Published
2025-10-29
·
Updated
2025-10-29
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as "a=;", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Stdlib