Ecosystem	Package	Version

Vulnerabilities

CVE-2025-61726

CVE-2025-61726

The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.

Published Feb 2, 2026

https://go.dev/issue/77101

CVSS ScoreHigh

7.5

Ecosystem	Package	Version


rpm	golang	1.11.1-1.el6
rpm	golang	1.11.2-1.el6
rpm	golang	1.11.2-3.el7
rpm	golang	1.11.4-1.el6
rpm	golang	1.11.4-1.el7
rpm	golang	1.11.5-1.el6
rpm	golang	1.11.5-1.el7
rpm	golang	1.13-1.el6
rpm	golang	1.13-1.el7
rpm	golang	1.13.1-1.el6
rpm	golang	1.13.1-1.el7
rpm	golang	1.13.11-1.el6
rpm	golang	1.13.11-1.el7
rpm	golang	1.13.14-1.el6
rpm	golang	1.13.14-1.el7
rpm	golang	1.13.3-1.el6
rpm	golang	1.13.3-1.el7
rpm	golang	1.13.6-1.el6
rpm	golang	1.13.6-1.el7
rpm	golang	1.15-1.el6
rpm	golang	1.15-1.el7
rpm	golang	1.15.14-1.el7
rpm	golang	1.15.2-1.el6
rpm	golang	1.15.2-1.el7
rpm	golang	1.15.5-1.el6
rpm	golang	1.15.5-1.el7
rpm	golang	1.16.13-1.el7
rpm	golang	1.16.13-2.el7
rpm	golang	1.17.10-1.el7
rpm	golang	1.17.12-1.el7
rpm	golang	1.17.7-1.el7
rpm	golang	1.18.4-1.el7
rpm	golang	1.18.9-1.el7
rpm	golang	1.19.10-1.el7
rpm	golang	1.19.13-1.el7
rpm	golang	1.19.6-1.el7
rpm	golang	1.19.9-1.el7
rpm	golang	1.20.10-3.el7
rpm	golang	1.20.12-1.el7
rpm	golang	1.7.6-1.el6
rpm	golang	1.7.6-2.el6
rpm	golang	1.9.2-1.el6
rpm	golang	1.9.4-1.el6
rpm	golang	1.9.6-1.el6
rpm	golang	1.9.7-1.el6
rpm	golang	1.11.13-2.module+el8.0.1+5331+cadcb96c
rpm	golang	1.11.13-2.module+el8.0.1+5334+cadcb96c
rpm	golang	1.11.5-1.module+el8+5188+42b7e240
rpm	golang	1.11.5-2.module+el8.0.0+5230+75360568
rpm	golang	1.11.6-1.module+el8.0.1+5237+ed1548cc

CVE-2025-61726 | Components Impacted | Sonatype Guide | Sonatype Guide