CVE-2025-61726

What it actually does

The vulnerability exists in Go's `net/url` package, where the `ParseForm` method in `net/http` does not enforce a limit on the number of query parameters it will parse from a request body. A remote, unauthenticated attacker can send a specially crafted HTTP request containing an extremely large number of unique form parameters. The server attempts to parse all of these parameters, leading to excessive memory allocation. This can exhaust the server's available memory, causing the application process to crash and resulting in a denial-of-service (DoS) condition.

Why it matters to the business

Exploitation of this vulnerability can lead to a denial of service, making critical web applications and APIs unavailable to legitimate users. This can result in service outages, direct revenue loss, disruption of business operations, and damage to the organization's reputation. Given the widespread use of Go for building backend services, the potential impact is significant across many industries.

How an attack unfolds

A remote, unauthenticated attacker targets a public-facing web application or API built with a vulnerable version of Go. The attacker crafts an HTTP POST request with the `Content-Type` header set to `application/x-www-form-urlencoded`. The body of this request is populated with a massive number of unique key-value pairs. When the target application receives this request and calls the `ParseForm` method to process the data, its memory consumption rapidly increases. This continues until the system's memory is exhausted, at which point the operating system terminates the application process to preserve system stability, effectively taking the service offline.

How to fix it

The primary remediation is to upgrade to a patched version of the Go toolchain and recompile affected applications. For specific products, upgrade to the versions indicated by the vendor, such as `grafana-alloy-fips` version `1.12.0-r1` or later. If immediate recompilation is not feasible, implement mitigating controls at a reverse proxy, load balancer, or Web Application Firewall (WAF). These controls should include strict limits on the maximum size of an HTTP request body and potentially the number of allowed parameters to prevent resource exhaustion.

How to confirm the fix worked

To validate the fix, confirm that all relevant applications have been recompiled with a non-vulnerable version of the Go compiler. To test for exposure, security teams can create a test script (e.g., using `curl`) to send an HTTP POST request with an `application/x-www-form-urlencoded` body containing tens of thousands of unique parameters to a non-production instance of the application. Monitor the application's memory usage during the test. A patched application should handle the request gracefully without crashing or consuming excessive memory, likely by rejecting it.

Typical attack path

1. The attacker identifies a public-facing web service or API endpoint built using a vulnerable version of the Go programming language.
2. The attacker crafts an HTTP POST request with a `Content-Type: application/x-www-form-urlencoded` header.
3. The attacker populates the request body with an exceptionally large number of unique form parameters.
4. The attacker sends the malicious request to the target endpoint.
5. The target Go application's `ParseForm` method begins parsing the request, consuming excessive memory for each parameter.
6. The application's memory usage spikes, leading to an out-of-memory error that crashes the process, causing a denial of service.

How to detect it

Monitor for exploitation attempts by analyzing web server and load balancer logs for HTTP POST requests with an `application/x-www-form-urlencoded` content type and an unusually large `Content-Length`. Use Application Performance Monitoring (APM) tools to watch for sudden, anomalous spikes in memory consumption on Go applications, especially if they are followed by process crashes or restarts. Anomaly detection rules that trigger on an abnormally high number of parsed form parameters per request can also indicate an attack.

What your security team should do

• Immediately identify and prioritize patching all public-facing web services and APIs compiled with vulnerable versions of Go.
• If patching cannot be done immediately, deploy a Web Application Firewall (WAF) or configure reverse proxies to enforce strict limits on request body size and the number of query parameters for all Go-based applications.
• Audit your software inventory and build pipelines to identify all projects using the vulnerable Go runtime and establish a plan for their upgrade and recompilation.