CVE-2025-58186: Go Standard Library Net/http

Medium severity, CVSS 5.3. EPSS: 0.6% chance of exploitation in the next 30 days.

Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as "a=;", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption.

Affected products

• Go Standard Library Net/http: before 1.24.8 (fixed in 1.24.8); from 1.25.0, before 1.25.2 (fixed in 1.25.2)

Published 2025-10-29. Last modified 2026-06-17.