Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Go 1.27.1 can use unlimited memory when handling web forms
published 27 days ago
Summary
The Go programming language version 1.27.1 may read very large pieces of data from a web form without stopping, which can fill up a server’s memory. This can slow down or crash the application that processes the form. Upgrade to a newer Go release that fixes the issue or apply the provided patch.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | golang | >= 1.27.0, <= 1.27.1-1 |
Original advisory text
CVE-2026-94440 affecting package golang 1.27.1-1
Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.
References
Timeline
Published8 Oct 2026
Updated11 Oct 2026
First seen11 Oct 2026
Sources
AZL-107478 · OSV
Track software like this
Free during beta