CVE-2017-1000098

The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "maxMemory" limit. It was possible for an attacker to generate a multipart request crafted such that the server ran out of file descriptors.

The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "maxMemory" limit. It was possible for an attacker to generate a multipart request crafted such that the server ran out of file descriptors.

When parsing large multipart/form-data, an attacker can cause a HTTP server to open a large number of file descriptors. This may be used as a denial-of-service vector.

El método Request.ParseMultipartForm del paquete net/http empieza a escribir en archivos temporales una vez que el tamaño del cuerpo de la petición sobrepase el límite "maxMemory" establecido. Un atacante podría generar un petición multipart manipulada para que el servidor se quede sin descriptores de archivo.