Bug 2548341 (CVE-2026-94440)
| Summary: | CVE-2026-94440 net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | akhatavk, amctagga, ansmith, anthomas, aoconnor, aos-team-art-private, asdas, bbrownin, bniver, chfoley, crizzo, dhanak, dkeler, dpaolell, drosa, dschmidt, dsimansk, eglynn, ehelms, flucifre, ggainey, gmeno, groman, jbritton, jburrell, jdelft, jeder, jjoyce, jlanda, jpasqual, jpretori, jschluet, jturenov, jupierce, juwatts, kingland, kshier, lchilton, lgarciaa, lhh, mbenjamin, mbiarnes, mburns, mdellweg, mgarciac, mhackett, mhulan, mnovotny, nmoumoul, osousa, pcreech, pjindal, ppalepu, ppostler, prdhamdh, rbobbitt, rchan, rhel-process-autobot, sausingh, sfeifer, sghai, sidsharm, simaishi, smallamp, sostapov, stcannon, suppawar, swoodman, thason, tmalecek, vereddy, vkarehfa, vlaad, watson-tool-maintainers, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in the mime/multipart and net/textproto packages in Go. A remote attacker could exploit this vulnerability by submitting a crafted multipart form request that bypasses configured memory limits when the remaining boundary limit is small. This issue allows the application to read an arbitrarily long line into memory, leading to excessive resource consumption and a Denial of Service (DoS).
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-10-08 23:01:40 UTC
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:89732 https://access.redhat.com/errata/RHSA-2026:89732 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:89884 https://access.redhat.com/errata/RHSA-2026:89884 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:89888 https://access.redhat.com/errata/RHSA-2026:89888 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:89885 https://access.redhat.com/errata/RHSA-2026:89885 This issue has been addressed in the following products: Red Hat OpenStack Services on OpenShift 18.0 Via RHSA-2026:90332 https://access.redhat.com/errata/RHSA-2026:90332 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:89933 https://access.redhat.com/errata/RHSA-2026:89933 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:91138 https://access.redhat.com/errata/RHSA-2026:91138 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:91572 https://access.redhat.com/errata/RHSA-2026:91572 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:91587 https://access.redhat.com/errata/RHSA-2026:91587 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:91646 https://access.redhat.com/errata/RHSA-2026:91646 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:91958 https://access.redhat.com/errata/RHSA-2026:91958 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:92372 https://access.redhat.com/errata/RHSA-2026:92372 This issue has been addressed in the following products: Red Hat Satellite 6.18 for RHEL 9 Via RHSA-2026:92860 https://access.redhat.com/errata/RHSA-2026:92860 This issue has been addressed in the following products: Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.16 for RHEL 9 Via RHSA-2026:92858 https://access.redhat.com/errata/RHSA-2026:92858 This issue has been addressed in the following products: Red Hat Satellite 6.17 for RHEL 9 Via RHSA-2026:92859 https://access.redhat.com/errata/RHSA-2026:92859 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:93596 https://access.redhat.com/errata/RHSA-2026:93596 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:93617 https://access.redhat.com/errata/RHSA-2026:93617 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:95016 https://access.redhat.com/errata/RHSA-2026:95016 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:95015 https://access.redhat.com/errata/RHSA-2026:95015 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:95014 https://access.redhat.com/errata/RHSA-2026:95014 |