A high-severity resource exhaustion vulnerability in the Go net/url package allows unauthenticated attackers to cause denial of service via memory consumption.

The vulnerability is an instance of CWE-400 (Uncontrolled Resource Consumption) within the net/http.Request.ParseForm method. An unauthenticated attacker can supply a specially crafted URL with a massive number of unique query parameters, forcing the application to allocate excessive memory and leading to a denial of service.

This vulnerability poses a significant risk to application availability. By triggering excessive memory consumption, an attacker can crash server processes, leading to service outages and potential business disruption. With a CVSS score of 7.5, the vulnerability is classified as High, reflecting the ease of exploitation over a network without requiring authentication or user interaction.

Immediate Action: Update your Go environment to the fixed versions (1.24.12 or 1.25.6) or higher as specified by the Go security advisory.

Proactive Monitoring: Monitor server memory usage and application crash logs for patterns consistent with rapid, unexpected memory spikes during HTTP request processing.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an ingress controller configured to limit the maximum number of query parameters or the total size of HTTP requests allowed to reach the backend services.

Public Exploit Available: Unknown

Given the foundational nature of the Go standard library, all developers and DevOps teams using affected versions of Go must prioritize upgrading their toolchains. Patching is the only definitive way to implement the necessary limits on query parameter parsing and protect against this denial of service vector.