{"cve":"CVE-2023-24534","nvd":{"published":"2023-04-06T16:15:07.657","modified":"2026-06-17T05:39:28.893","status":"Modified","description":"HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service. With fix, header parsing now correctly allocates only the memory required to hold parsed headers.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-400"],"references":["https://go.dev/cl/481994","https://go.dev/issue/58975","https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8","https://pkg.go.dev/vuln/GO-2023-1704","https://security.gentoo.org/glsa/202311-09"],"products":["golang:go"],"source":"nvd","synced_at":"2026-10-19T21:37:48.383111019+00:00"},"epss":{"cve":"CVE-2023-24534","score":0.01888,"percentile":0.79534,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GO-2023-1704","url":"https://osv.dev/vulnerability/GO-2023-1704","summary":"Excessive memory allocation in net/http and net/textproto","modified":"2026-02-04T04:39:41.032390Z","packages":[{"ecosystem":"Go","name":"stdlib","purl":"pkg:golang/stdlib","ranges":["<1.19.8",">=1.20.0-0 <1.20.3"],"fixed":["1.19.8","1.20.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}