CVE-2025-61726: Go net/url Package DoS Vulnerability

CVE-2025-61726 Overview

CVE-2025-61726 is a resource exhaustion vulnerability in Go's net/url package that fails to limit the number of query parameters in a URL. While URLs typically have size constraints imposed by request header limits, the net/http.Request.ParseForm method can process large URL-encoded forms without restriction. An attacker can exploit this by submitting forms with many unique query parameters, leading to excessive memory consumption and potential denial of service conditions.

Critical Impact

Applications using Go's standard library for URL parsing and form handling may be vulnerable to memory exhaustion attacks, potentially causing service disruption in production environments.

Affected Products

• Go standard library net/url package
• Go standard library net/http package
• Applications using net/http.Request.ParseForm method

Discovery Timeline

• 2026-01-28 - CVE CVE-2025-61726 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2025-61726

Vulnerability Analysis

This vulnerability is classified as a resource exhaustion denial of service (DoS) issue. The root cause lies in the absence of limits on the number of query parameters that can be parsed from URL-encoded data. When an application calls ParseForm on a request, the underlying implementation allocates memory for each unique parameter key-value pair without imposing any ceiling on the total count.

The attack is network-accessible and requires no authentication or user interaction, making it relatively straightforward to exploit against vulnerable web services. The primary impact is on service availability, as memory exhaustion can cause application crashes or severe performance degradation.

Root Cause

The net/url package's query parsing logic does not enforce a maximum threshold on the number of discrete query parameters it will process. This design oversight allows unbounded memory allocation when parsing attacker-controlled input. The net/http.Request.ParseForm method inherits this behavior, creating a pathway for exploitation through HTTP request handling.

Attack Vector

An attacker can craft malicious HTTP requests containing URL-encoded form data with thousands or millions of unique query parameters. When the target application processes such a request using ParseForm, each parameter consumes memory for storage. By sending repeated requests or a single large payload, an attacker can exhaust available memory resources.

The vulnerability is exploitable remotely over the network. An attacker would construct a request with a large number of unique key-value pairs in the form body or URL query string, then submit this to any endpoint that parses form data. The Go runtime will attempt to allocate memory for all parameters, potentially leading to memory exhaustion.

For technical implementation details, refer to the Go.dev Code Change Notice and the Go.dev Issue Tracker.

Detection Methods for CVE-2025-61726

Indicators of Compromise

• Unusual memory consumption spikes in Go applications handling HTTP requests
• HTTP requests with abnormally large query strings or POST bodies
• Application crashes or out-of-memory (OOM) errors correlating with incoming requests
• Slow response times or service degradation during traffic with high parameter counts

Detection Strategies

• Monitor application memory usage for unexpected growth patterns during request processing
• Implement request size limits at the reverse proxy or load balancer level
• Enable application-level logging for requests with high parameter counts
• Deploy runtime monitoring to detect memory allocation anomalies in Go services

Monitoring Recommendations

• Set up alerts for memory utilization exceeding baseline thresholds on Go application servers
• Log and analyze requests with unusually large Content-Length headers
• Monitor for repeated requests from single sources targeting form-processing endpoints
• Track garbage collection pressure and heap size in Go application metrics

How to Mitigate CVE-2025-61726

Immediate Actions Required

• Update Go installations to patched versions that address CVE-2025-61726
• Implement request body size limits at the web server or reverse proxy level
• Add application-level validation to limit the number of accepted query parameters
• Review application code for usage of net/http.Request.ParseForm and similar methods

Patch Information

The Go development team has addressed this vulnerability in updated releases. Refer to the Golang Announcement Group Post for official patch release information. The Go.dev Vulnerability Advisory #GO-2026-4341 provides specific version guidance and remediation instructions.

Organizations should prioritize updating their Go runtime and rebuilding affected applications with the patched version.

Workarounds

• Configure reverse proxies (nginx, HAProxy) to limit maximum request body and URL sizes
• Implement custom middleware to count and reject requests exceeding a parameter threshold
• Use http.MaxBytesReader to limit the size of request bodies before parsing
• Consider rate limiting on endpoints that process form data to reduce attack impact

# Example nginx configuration to limit request body size
# Add to server or location block
client_max_body_size 1m;
client_body_buffer_size 16k;
large_client_header_buffers 4 8k;