Golang: stdlib: security update to 1.19.8stdlib: security update to 1.20.3

high Tenable Self-Hosted Container Security Plugin ID 428512

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing
very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the
total memory a parsed multipart form can consume. ReadForm can undercount the amount of memory consumed,
leading it to accept larger inputs than intended. 2. Limiting total memory does not account for increased
pressure on the garbage collector from large numbers of small allocations in forms with many parts. 3.
ReadForm can allocate a large number of short-lived buffers, further increasing pressure on the garbage
collector. The combination of these factors can permit an attacker to cause an program that parses
multipart forms to consume large amounts of CPU and memory, potentially resulting in a denial of service.
This affects programs that use mime/multipart.Reader.ReadForm, as well as form parsing in the net/http
package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. With fix,
ReadForm now does a better job of estimating the memory consumption of parsed forms, and performs many
fewer short-lived allocations. In addition, the fixed mime/multipart.Reader imposes the following limits
on the size of parsed forms: 1. Forms parsed with ReadForm may contain no more than 1000 parts. This limit
may be adjusted with the environment variable GODEBUG=multipartmaxparts=. 2. Form parts parsed with
NextPart and NextRawPart may contain no more than 10,000 header fields. In addition, forms parsed with
ReadForm may contain no more than 10,000 header fields across all parts. This limit may be adjusted with
the environment variable GODEBUG=multipartmaxheaders=. (CVE-2023-24536)

Plugin Details

Severity: High

ID: 428512

Version: Revision 1.4

Type: Local

Family: Golang

Published: 7/21/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.39

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2023-24536

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 4/5/2023

Vulnerability Publication Date: 4/5/2023

Reference Information

CVE: CVE-2023-24536

Detections

Analytics