CVE-2025-61726
Memory exhaustion in query parameter parsing in net/url
HIGH
7.5
CVSS Score
Published: January 28, 2026 at 07:30 PM UTC
Updated: September 17, 2026 at 12:17 PM UTC
45 products affected across 3 vendorsGoEnterprise LinuxOpenShift Container Platform
Using net/url by Go standard library?
Get instant alerts when new vulnerabilities affect net/url - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.5
Exploit prediction
EPSS 2%
SSVC
No known exploit
Description
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
v < 1.24.121.25.0 ≤ v < 1.25.6
Affected range stops below 1.24.12, so it looks safe — our inference, not a vendor statement
Affected range stops below 1.25.6, so it looks safe — our inference, not a vendor statement
Affected range stops below 1.24.12, so it looks safe — our inference, not a vendor statement
Affected range stops below 1.25.6, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 1774084104 (unaffected)
Vendor states this is fixed in 1774085848 (unaffected)
Vendor states this is fixed in 1774086225 (unaffected)
Vendor states this is fixed in 1774332596 (unaffected)
Vendor states this is fixed in 1774550347 (unaffected)
Vendor states this is fixed in 1774550350 (unaffected)
Vendor states this is fixed in 1774550357 (unaffected)
Vendor states this is fixed in 1774915148 (unaffected)
Vendor states this is fixed in 1774915173 (unaffected)
Vendor states this is fixed in 1774915248 (unaffected)
Vendor states this is fixed in 1774915330 (unaffected)
Vendor states this is fixed in 1774915333 (unaffected)
Vendor states this is fixed in 1774915336 (unaffected)
Vendor states this is fixed in 1774915533 (unaffected)
Vendor states this is fixed in 1774915538 (unaffected)
Vendor states this is fixed in 1774984227 (unaffected)
Vendor states this is fixed in 1775176904 (unaffected)
Vendor states this is fixed in 1775326442 (unaffected)
Vendor states this is fixed in 1775441299 (unaffected)
Vendor states this is fixed in 1775585006 (unaffected)
Vendor states this is fixed in 1776395605 (unaffected)
Vendor states this is fixed in 1776693014 (unaffected)
Vendor states this is fixed in 1776815733 (unaffected)
Vendor states this is fixed in 1776817795 (unaffected)
Vendor states this is fixed in 1776824009 (unaffected)
Vendor states this is fixed in 1777127371 (unaffected)
Vendor states this is fixed in 1777138376 (unaffected)
Vendor states this is fixed in 1777141836 (unaffected)
Vendor states this is fixed in 1777380373 (unaffected)
Vendor states this is fixed in 1777406548 (unaffected)
Vendor states this is fixed in 1780204232 (unaffected)
Vendor states this is fixed in 1780204249 (unaffected)
Vendor states this is fixed in 1780204322 (unaffected)
Vendor states this is fixed in 1780204631 (unaffected)
Vendor states this is fixed in 1780204696 (unaffected)
Vendor states this is fixed in 1780204887 (unaffected)
Vendor states this is fixed in 1780238563 (unaffected)
Vendor states this is fixed in 1782517171 (unaffected)
Vendor states this is fixed in 1782862719 (unaffected)
Vendor states this is fixed in 1782924920 (unaffected)
Vendor states this is fixed in 1782924937 (unaffected)
Vendor states this is fixed in 1782925247 (unaffected)
Vendor states this is fixed in 1782925266 (unaffected)
Vendor states this is fixed in 1782925328 (unaffected)
Vendor states this is fixed in 1782926302 (unaffected)
Vendor states this is fixed in 1782933193 (unaffected)
Vendor states this is fixed in 1782945263 (unaffected)
Vendor states this is fixed in 1783208498 (unaffected)
Vendor states this is fixed in 1783329407 (unaffected)
Vendor states this is fixed in 1783330172 (unaffected)
Vendor states this is fixed in 1783349781 (unaffected)
Vendor states this is fixed in 1783350872 (unaffected)
Vendor states this is fixed in 1783351609 (unaffected)
Vendor states this is fixed in 1783352124 (unaffected)
Vendor states this is fixed in 1784133634 (unaffected)
Vendor states this is fixed in 2 (unaffected)
Vendor states this is fixed in 0:1.6.3-4.el10ap (unaffected)
Vendor states this is fixed in 0:1.6.3-4.el8ap (unaffected)
Vendor states this is fixed in 0:1.6.3-4.el9ap (unaffected)
Vendor states this is fixed in 0:2.5.10-4.el8ap (unaffected)
Vendor states this is fixed in 0:2.6.14-1.el9 (unaffected)
Vendor states this is fixed in 1772498155 (unaffected)
Vendor states this is fixed in 2 (unaffected)
60%
All versions
Vendor states this is fixed in 1774341716 (unaffected)
Vendor states this is fixed in 1774342146 (unaffected)
All versions
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
References (288)
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
https://access.redhat.com/errata/RHSA-2026:10096Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
https://access.redhat.com/errata/RHSA-2026:10104Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
https://access.redhat.com/errata/RHSA-2026:10184Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
https://access.redhat.com/errata/RHSA-2026:10225SSVC — Action Prioritization
SSVCNo known exploitAutomatablePartial impact
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
7.5HIGHCISA-ADP
- Attack Vector
- NETWORK
- Complexity
- LOW
- Privileges
- NONE
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- NONE
- Integrity
- NONE
- Availability
- HIGH
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-770
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card