« Volver al listado

CVE-2025-58186

Estado: AplazadaMedia (5.3)—

Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as "a=;", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-58186",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-58186",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-10-30T14:24:44.763207Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@golang.org",
      "affectedData": [
        {
          "vendor": "Go standard library",
          "product": "net/http",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.24.8",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.25.0",
              "lessThan": "1.25.2",
              "versionType": "semver"
            }
          ],
          "packageName": "net/http",
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "ParseCookie"
            },
            {
              "name": "readSetCookies"
            },
            {
              "name": "readCookies"
            },
            {
              "name": "Client.Do"
            },
            {
              "name": "Client.Get"
            },
            {
              "name": "Client.Head"
            },
            {
              "name": "Client.Post"
            },
            {
              "name": "Client.PostForm"
            },
            {
              "name": "Get"
            },
            {
              "name": "Head"
            },
            {
              "name": "Post"
            },
            {
              "name": "PostForm"
            },
            {
              "name": "Request.Cookie"
            },
            {
              "name": "Request.Cookies"
            },
            {
              "name": "Request.CookiesNamed"
            },
            {
              "name": "Response.Cookies"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-10-29T23:16:19.547",
  "references": [
    {
      "url": "https://go.dev/cl/709855",
      "source": "security@golang.org"
    },
    {
      "url": "https://go.dev/issue/75672",
      "source": "security@golang.org"
    },
    {
      "url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI",
      "source": "security@golang.org"
    },
    {
      "url": "https://pkg.go.dev/vuln/GO-2025-4012",
      "source": "security@golang.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2025/10/08/1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as \"a=;\", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption."
    }
  ],
  "lastModified": "2026-06-17T09:44:01.983",
  "sourceIdentifier": "security@golang.org"
}