{"id":"CVE-2026-94440","published":"2026-10-08T23:17:04.917","lastModified":"2026-10-09T17:16:50.907","description":"Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-770"],"vendors":[],"products":[],"references":[{"url":"https://go.dev/cl/847307","tags":[]},{"url":"https://go.dev/issue/81741","tags":[]},{"url":"https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","tags":[]},{"url":"https://pkg.go.dev/vuln/GO-2026-6608","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A memory exhaustion vulnerability in multipart form parsing allows attackers to bypass memory limits and read arbitrarily long lines into memory when remaining limit is less than 400 bytes, potentially leading to denial of service.","exploitability":"Exploitation requires sending a specially crafted multipart form request with a part that has less than 400 bytes remaining in its limit, making it moderately difficult to exploit without specific application configuration or access patterns.","blast_radius":"The vulnerability could affect any web application processing multipart forms, potentially causing widespread denial of service across affected services.","remediation":"Upgrade to version 2.590 or later to address the memory limit bypass in multipart form parsing.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["dos","web","memory"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:23:42.724Z"}}