The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

References
Link Providers
https://access.redhat.com/errata/RHSA-2026:10096 cve-icon
https://access.redhat.com/errata/RHSA-2026:10104 cve-icon
https://access.redhat.com/errata/RHSA-2026:10184 cve-icon
https://access.redhat.com/errata/RHSA-2026:10225 cve-icon
https://access.redhat.com/errata/RHSA-2026:10250 cve-icon
https://access.redhat.com/errata/RHSA-2026:11408 cve-icon
https://access.redhat.com/errata/RHSA-2026:11414 cve-icon
https://access.redhat.com/errata/RHSA-2026:11747 cve-icon
https://access.redhat.com/errata/RHSA-2026:11749 cve-icon
https://access.redhat.com/errata/RHSA-2026:12028 cve-icon
https://access.redhat.com/errata/RHSA-2026:12029 cve-icon
https://access.redhat.com/errata/RHSA-2026:12030 cve-icon
https://access.redhat.com/errata/RHSA-2026:12031 cve-icon
https://access.redhat.com/errata/RHSA-2026:12032 cve-icon
https://access.redhat.com/errata/RHSA-2026:12033 cve-icon
https://access.redhat.com/errata/RHSA-2026:12279 cve-icon
https://access.redhat.com/errata/RHSA-2026:12282 cve-icon
https://access.redhat.com/errata/RHSA-2026:13542 cve-icon
https://access.redhat.com/errata/RHSA-2026:13548 cve-icon
https://access.redhat.com/errata/RHSA-2026:13571 cve-icon
https://access.redhat.com/errata/RHSA-2026:14100 cve-icon
https://access.redhat.com/errata/RHSA-2026:14774 cve-icon
https://access.redhat.com/errata/RHSA-2026:14868 cve-icon
https://access.redhat.com/errata/RHSA-2026:14879 cve-icon
https://access.redhat.com/errata/RHSA-2026:15091 cve-icon
https://access.redhat.com/errata/RHSA-2026:15984 cve-icon
https://access.redhat.com/errata/RHSA-2026:16102 cve-icon
https://access.redhat.com/errata/RHSA-2026:16696 cve-icon
https://access.redhat.com/errata/RHSA-2026:17040 cve-icon
https://access.redhat.com/errata/RHSA-2026:17084 cve-icon
https://access.redhat.com/errata/RHSA-2026:17446 cve-icon
https://access.redhat.com/errata/RHSA-2026:17460 cve-icon
https://access.redhat.com/errata/RHSA-2026:17463 cve-icon
https://access.redhat.com/errata/RHSA-2026:17468 cve-icon
https://access.redhat.com/errata/RHSA-2026:17595 cve-icon
https://access.redhat.com/errata/RHSA-2026:17598 cve-icon
https://access.redhat.com/errata/RHSA-2026:18913 cve-icon
https://access.redhat.com/errata/RHSA-2026:19013 cve-icon
https://access.redhat.com/errata/RHSA-2026:19132 cve-icon
https://access.redhat.com/errata/RHSA-2026:19375 cve-icon
https://access.redhat.com/errata/RHSA-2026:19634 cve-icon
https://access.redhat.com/errata/RHSA-2026:19712 cve-icon
https://access.redhat.com/errata/RHSA-2026:20041 cve-icon
https://access.redhat.com/errata/RHSA-2026:21017 cve-icon
https://access.redhat.com/errata/RHSA-2026:21657 cve-icon
https://access.redhat.com/errata/RHSA-2026:21691 cve-icon
https://access.redhat.com/errata/RHSA-2026:22450 cve-icon
https://access.redhat.com/errata/RHSA-2026:22627 cve-icon
https://access.redhat.com/errata/RHSA-2026:22714 cve-icon
https://access.redhat.com/errata/RHSA-2026:22937 cve-icon
https://access.redhat.com/errata/RHSA-2026:23228 cve-icon
https://access.redhat.com/errata/RHSA-2026:23361 cve-icon
https://access.redhat.com/errata/RHSA-2026:24977 cve-icon
https://access.redhat.com/errata/RHSA-2026:25089 cve-icon
https://access.redhat.com/errata/RHSA-2026:25127 cve-icon
https://access.redhat.com/errata/RHSA-2026:25248 cve-icon
https://access.redhat.com/errata/RHSA-2026:25250 cve-icon
https://access.redhat.com/errata/RHSA-2026:25251 cve-icon
https://access.redhat.com/errata/RHSA-2026:25252 cve-icon
https://access.redhat.com/errata/RHSA-2026:25253 cve-icon
https://access.redhat.com/errata/RHSA-2026:26420 cve-icon
https://access.redhat.com/errata/RHSA-2026:26527 cve-icon
https://access.redhat.com/errata/RHSA-2026:26541 cve-icon
https://access.redhat.com/errata/RHSA-2026:26636 cve-icon
https://access.redhat.com/errata/RHSA-2026:2681 cve-icon
https://access.redhat.com/errata/RHSA-2026:2706 cve-icon
https://access.redhat.com/errata/RHSA-2026:2708 cve-icon
https://access.redhat.com/errata/RHSA-2026:2709 cve-icon
https://access.redhat.com/errata/RHSA-2026:2754 cve-icon
https://access.redhat.com/errata/RHSA-2026:28047 cve-icon
https://access.redhat.com/errata/RHSA-2026:2844 cve-icon
https://access.redhat.com/errata/RHSA-2026:28441 cve-icon
https://access.redhat.com/errata/RHSA-2026:28886 cve-icon
https://access.redhat.com/errata/RHSA-2026:28961 cve-icon
https://access.redhat.com/errata/RHSA-2026:2914 cve-icon
https://access.redhat.com/errata/RHSA-2026:2920 cve-icon
https://access.redhat.com/errata/RHSA-2026:3035 cve-icon
https://access.redhat.com/errata/RHSA-2026:3040 cve-icon
https://access.redhat.com/errata/RHSA-2026:3089 cve-icon
https://access.redhat.com/errata/RHSA-2026:3092 cve-icon
https://access.redhat.com/errata/RHSA-2026:3184 cve-icon
https://access.redhat.com/errata/RHSA-2026:3186 cve-icon
https://access.redhat.com/errata/RHSA-2026:3187 cve-icon
https://access.redhat.com/errata/RHSA-2026:3188 cve-icon
https://access.redhat.com/errata/RHSA-2026:3192 cve-icon
https://access.redhat.com/errata/RHSA-2026:3193 cve-icon
https://access.redhat.com/errata/RHSA-2026:3291 cve-icon
https://access.redhat.com/errata/RHSA-2026:3296 cve-icon
https://access.redhat.com/errata/RHSA-2026:3297 cve-icon
https://access.redhat.com/errata/RHSA-2026:3298 cve-icon
https://access.redhat.com/errata/RHSA-2026:3336 cve-icon
https://access.redhat.com/errata/RHSA-2026:3337 cve-icon
https://access.redhat.com/errata/RHSA-2026:3340 cve-icon
https://access.redhat.com/errata/RHSA-2026:3341 cve-icon
https://access.redhat.com/errata/RHSA-2026:3343 cve-icon
https://access.redhat.com/errata/RHSA-2026:3391 cve-icon
https://access.redhat.com/errata/RHSA-2026:3416 cve-icon
https://access.redhat.com/errata/RHSA-2026:3427 cve-icon
https://access.redhat.com/errata/RHSA-2026:3459 cve-icon
https://access.redhat.com/errata/RHSA-2026:3468 cve-icon
https://access.redhat.com/errata/RHSA-2026:3469 cve-icon
https://access.redhat.com/errata/RHSA-2026:3470 cve-icon
https://access.redhat.com/errata/RHSA-2026:3471 cve-icon
https://access.redhat.com/errata/RHSA-2026:3472 cve-icon
https://access.redhat.com/errata/RHSA-2026:3473 cve-icon
https://access.redhat.com/errata/RHSA-2026:3489 cve-icon
https://access.redhat.com/errata/RHSA-2026:3506 cve-icon
https://access.redhat.com/errata/RHSA-2026:3556 cve-icon
https://access.redhat.com/errata/RHSA-2026:3559 cve-icon
https://access.redhat.com/errata/RHSA-2026:3668 cve-icon
https://access.redhat.com/errata/RHSA-2026:3669 cve-icon
https://access.redhat.com/errata/RHSA-2026:36873 cve-icon
https://access.redhat.com/errata/RHSA-2026:36882 cve-icon
https://access.redhat.com/errata/RHSA-2026:3699 cve-icon
https://access.redhat.com/errata/RHSA-2026:3713 cve-icon
https://access.redhat.com/errata/RHSA-2026:37275 cve-icon
https://access.redhat.com/errata/RHSA-2026:3752 cve-icon
https://access.redhat.com/errata/RHSA-2026:3753 cve-icon
https://access.redhat.com/errata/RHSA-2026:3782 cve-icon
https://access.redhat.com/errata/RHSA-2026:3812 cve-icon
https://access.redhat.com/errata/RHSA-2026:3813 cve-icon
https://access.redhat.com/errata/RHSA-2026:3814 cve-icon
https://access.redhat.com/errata/RHSA-2026:3815 cve-icon
https://access.redhat.com/errata/RHSA-2026:3816 cve-icon
https://access.redhat.com/errata/RHSA-2026:3817 cve-icon
https://access.redhat.com/errata/RHSA-2026:3818 cve-icon
https://access.redhat.com/errata/RHSA-2026:3820 cve-icon
https://access.redhat.com/errata/RHSA-2026:3821 cve-icon
https://access.redhat.com/errata/RHSA-2026:3822 cve-icon
https://access.redhat.com/errata/RHSA-2026:3831 cve-icon
https://access.redhat.com/errata/RHSA-2026:3833 cve-icon
https://access.redhat.com/errata/RHSA-2026:3835 cve-icon
https://access.redhat.com/errata/RHSA-2026:3836 cve-icon
https://access.redhat.com/errata/RHSA-2026:3838 cve-icon
https://access.redhat.com/errata/RHSA-2026:3839 cve-icon
https://access.redhat.com/errata/RHSA-2026:3840 cve-icon
https://access.redhat.com/errata/RHSA-2026:3841 cve-icon
https://access.redhat.com/errata/RHSA-2026:3843 cve-icon
https://access.redhat.com/errata/RHSA-2026:3854 cve-icon
https://access.redhat.com/errata/RHSA-2026:3855 cve-icon
https://access.redhat.com/errata/RHSA-2026:3856 cve-icon
https://access.redhat.com/errata/RHSA-2026:3864 cve-icon
https://access.redhat.com/errata/RHSA-2026:3869 cve-icon
https://access.redhat.com/errata/RHSA-2026:3874 cve-icon
https://access.redhat.com/errata/RHSA-2026:3875 cve-icon
https://access.redhat.com/errata/RHSA-2026:3879 cve-icon
https://access.redhat.com/errata/RHSA-2026:3880 cve-icon
https://access.redhat.com/errata/RHSA-2026:3884 cve-icon
https://access.redhat.com/errata/RHSA-2026:3898 cve-icon
https://access.redhat.com/errata/RHSA-2026:3905 cve-icon
https://access.redhat.com/errata/RHSA-2026:3906 cve-icon
https://access.redhat.com/errata/RHSA-2026:3928 cve-icon
https://access.redhat.com/errata/RHSA-2026:3929 cve-icon
https://access.redhat.com/errata/RHSA-2026:3930 cve-icon
https://access.redhat.com/errata/RHSA-2026:3931 cve-icon
https://access.redhat.com/errata/RHSA-2026:3932 cve-icon
https://access.redhat.com/errata/RHSA-2026:3958 cve-icon
https://access.redhat.com/errata/RHSA-2026:3959 cve-icon
https://access.redhat.com/errata/RHSA-2026:3960 cve-icon
https://access.redhat.com/errata/RHSA-2026:3970 cve-icon
https://access.redhat.com/errata/RHSA-2026:3971 cve-icon
https://access.redhat.com/errata/RHSA-2026:3972 cve-icon
https://access.redhat.com/errata/RHSA-2026:3973 cve-icon
https://access.redhat.com/errata/RHSA-2026:3974 cve-icon
https://access.redhat.com/errata/RHSA-2026:3977 cve-icon
https://access.redhat.com/errata/RHSA-2026:39810 cve-icon
https://access.redhat.com/errata/RHSA-2026:3985 cve-icon
https://access.redhat.com/errata/RHSA-2026:40924 cve-icon
https://access.redhat.com/errata/RHSA-2026:4164 cve-icon
https://access.redhat.com/errata/RHSA-2026:4166 cve-icon
https://access.redhat.com/errata/RHSA-2026:4170 cve-icon
https://access.redhat.com/errata/RHSA-2026:4174 cve-icon
https://access.redhat.com/errata/RHSA-2026:4177 cve-icon
https://access.redhat.com/errata/RHSA-2026:41928 cve-icon
https://access.redhat.com/errata/RHSA-2026:41941 cve-icon
https://access.redhat.com/errata/RHSA-2026:4211 cve-icon
https://access.redhat.com/errata/RHSA-2026:4220 cve-icon
https://access.redhat.com/errata/RHSA-2026:4256 cve-icon
https://access.redhat.com/errata/RHSA-2026:4264 cve-icon
https://access.redhat.com/errata/RHSA-2026:4267 cve-icon
https://access.redhat.com/errata/RHSA-2026:4270 cve-icon
https://access.redhat.com/errata/RHSA-2026:4276 cve-icon
https://access.redhat.com/errata/RHSA-2026:4434 cve-icon
https://access.redhat.com/errata/RHSA-2026:4435 cve-icon
https://access.redhat.com/errata/RHSA-2026:4460 cve-icon
https://access.redhat.com/errata/RHSA-2026:4466 cve-icon
https://access.redhat.com/errata/RHSA-2026:4467 cve-icon
https://access.redhat.com/errata/RHSA-2026:4498 cve-icon
https://access.redhat.com/errata/RHSA-2026:4500 cve-icon
https://access.redhat.com/errata/RHSA-2026:4510 cve-icon
https://access.redhat.com/errata/RHSA-2026:4511 cve-icon
https://access.redhat.com/errata/RHSA-2026:4672 cve-icon
https://access.redhat.com/errata/RHSA-2026:46903 cve-icon
https://access.redhat.com/errata/RHSA-2026:4753 cve-icon
https://access.redhat.com/errata/RHSA-2026:4892 cve-icon
https://access.redhat.com/errata/RHSA-2026:4901 cve-icon
https://access.redhat.com/errata/RHSA-2026:4907 cve-icon
https://access.redhat.com/errata/RHSA-2026:4939 cve-icon
https://access.redhat.com/errata/RHSA-2026:4942 cve-icon
https://access.redhat.com/errata/RHSA-2026:4943 cve-icon
https://access.redhat.com/errata/RHSA-2026:4952 cve-icon
https://access.redhat.com/errata/RHSA-2026:49944 cve-icon
https://access.redhat.com/errata/RHSA-2026:5022 cve-icon
https://access.redhat.com/errata/RHSA-2026:5030 cve-icon
https://access.redhat.com/errata/RHSA-2026:5031 cve-icon
https://access.redhat.com/errata/RHSA-2026:5076 cve-icon
https://access.redhat.com/errata/RHSA-2026:5077 cve-icon
https://access.redhat.com/errata/RHSA-2026:5078 cve-icon
https://access.redhat.com/errata/RHSA-2026:5079 cve-icon
https://access.redhat.com/errata/RHSA-2026:51033 cve-icon
https://access.redhat.com/errata/RHSA-2026:5110 cve-icon
https://access.redhat.com/errata/RHSA-2026:51288 cve-icon
https://access.redhat.com/errata/RHSA-2026:5129 cve-icon
https://access.redhat.com/errata/RHSA-2026:5130 cve-icon
https://access.redhat.com/errata/RHSA-2026:5131 cve-icon
https://access.redhat.com/errata/RHSA-2026:5132 cve-icon
https://access.redhat.com/errata/RHSA-2026:5145 cve-icon
https://access.redhat.com/errata/RHSA-2026:5146 cve-icon
https://access.redhat.com/errata/RHSA-2026:5168 cve-icon
https://access.redhat.com/errata/RHSA-2026:5327 cve-icon
https://access.redhat.com/errata/RHSA-2026:5394 cve-icon
https://access.redhat.com/errata/RHSA-2026:5439 cve-icon
https://access.redhat.com/errata/RHSA-2026:5444 cve-icon
https://access.redhat.com/errata/RHSA-2026:5447 cve-icon
https://access.redhat.com/errata/RHSA-2026:5452 cve-icon
https://access.redhat.com/errata/RHSA-2026:5461 cve-icon
https://access.redhat.com/errata/RHSA-2026:5463 cve-icon
https://access.redhat.com/errata/RHSA-2026:5533 cve-icon
https://access.redhat.com/errata/RHSA-2026:5544 cve-icon
https://access.redhat.com/errata/RHSA-2026:5549 cve-icon
https://access.redhat.com/errata/RHSA-2026:5636 cve-icon
https://access.redhat.com/errata/RHSA-2026:5645 cve-icon
https://access.redhat.com/errata/RHSA-2026:5649 cve-icon
https://access.redhat.com/errata/RHSA-2026:5665 cve-icon
https://access.redhat.com/errata/RHSA-2026:5807 cve-icon
https://access.redhat.com/errata/RHSA-2026:5851 cve-icon
https://access.redhat.com/errata/RHSA-2026:5852 cve-icon
https://access.redhat.com/errata/RHSA-2026:5853 cve-icon
https://access.redhat.com/errata/RHSA-2026:5948 cve-icon
https://access.redhat.com/errata/RHSA-2026:5950 cve-icon
https://access.redhat.com/errata/RHSA-2026:5952 cve-icon
https://access.redhat.com/errata/RHSA-2026:5968 cve-icon
https://access.redhat.com/errata/RHSA-2026:6184 cve-icon
https://access.redhat.com/errata/RHSA-2026:6192 cve-icon
https://access.redhat.com/errata/RHSA-2026:6226 cve-icon
https://access.redhat.com/errata/RHSA-2026:6251 cve-icon
https://access.redhat.com/errata/RHSA-2026:6277 cve-icon
https://access.redhat.com/errata/RHSA-2026:6278 cve-icon
https://access.redhat.com/errata/RHSA-2026:6428 cve-icon
https://access.redhat.com/errata/RHSA-2026:6429 cve-icon
https://access.redhat.com/errata/RHSA-2026:6497 cve-icon
https://access.redhat.com/errata/RHSA-2026:6554 cve-icon
https://access.redhat.com/errata/RHSA-2026:6564 cve-icon
https://access.redhat.com/errata/RHSA-2026:6567 cve-icon
https://access.redhat.com/errata/RHSA-2026:6568 cve-icon
https://access.redhat.com/errata/RHSA-2026:7052 cve-icon
https://access.redhat.com/errata/RHSA-2026:7249 cve-icon
https://access.redhat.com/errata/RHSA-2026:7291 cve-icon
https://access.redhat.com/errata/RHSA-2026:7385 cve-icon
https://access.redhat.com/errata/RHSA-2026:7676 cve-icon
https://access.redhat.com/errata/RHSA-2026:7854 cve-icon
https://access.redhat.com/errata/RHSA-2026:7942 cve-icon
https://access.redhat.com/errata/RHSA-2026:8151 cve-icon
https://access.redhat.com/errata/RHSA-2026:8167 cve-icon
https://access.redhat.com/errata/RHSA-2026:8218 cve-icon
https://access.redhat.com/errata/RHSA-2026:8229 cve-icon
https://access.redhat.com/errata/RHSA-2026:8337 cve-icon
https://access.redhat.com/errata/RHSA-2026:8338 cve-icon
https://access.redhat.com/errata/RHSA-2026:8431 cve-icon
https://access.redhat.com/errata/RHSA-2026:8433 cve-icon
https://access.redhat.com/errata/RHSA-2026:8483 cve-icon
https://access.redhat.com/errata/RHSA-2026:9097 cve-icon
https://access.redhat.com/errata/RHSA-2026:9098 cve-icon
https://access.redhat.com/errata/RHSA-2026:9108 cve-icon
https://access.redhat.com/errata/RHSA-2026:9109 cve-icon
https://access.redhat.com/errata/RHSA-2026:9848 cve-icon
https://access.redhat.com/security/cve/CVE-2025-61726 cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2434432 cve-icon
https://go.dev/cl/736712 cve-icon cve-icon cve-icon
https://go.dev/issue/77101 cve-icon cve-icon cve-icon
https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-61726 cve-icon
https://pkg.go.dev/vuln/GO-2026-4341 cve-icon cve-icon cve-icon
https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61726.json cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-61726 cve-icon
History

Fri, 06 Feb 2026 19:00:00 +0000

Type Values Removed Values Added
First Time appeared Golang
Golang go
CPEs cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
Vendors & Products Golang
Golang go

Tue, 03 Feb 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-770
References
Metrics threat_severity

None

threat_severity

Important


Fri, 30 Jan 2026 00:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Thu, 29 Jan 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}


Thu, 29 Jan 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Go Standard Library
Go Standard Library net/url
Vendors & Products Go Standard Library
Go Standard Library net/url

Wed, 28 Jan 2026 19:45:00 +0000

Type Values Removed Values Added
Description The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.
Title Memory exhaustion in query parameter parsing in net/url
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Go

Published:

Updated: 2026-08-12T12:04:55.248Z

Reserved: 2025-09-30T15:05:03.605Z

Link: CVE-2025-61726

cve-icon Vulnrichment

Updated: 2026-08-12T12:04:55.248Z

cve-icon NVD

Status : Modified

Published: 2026-01-28T20:16:09.713

Modified: 2026-08-12T12:17:25.677

Link: CVE-2025-61726

cve-icon Redhat

Severity : Important

Publid Date: 2026-01-28T19:30:31Z

Links: CVE-2025-61726 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-01-29T09:08:59Z

Weaknesses