CVE-2025-58186 Lack of limit when parsing cookies can cause memory exhaustion in net/http

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Memory Exhaustion Vulnerabilities in Net/HTTP and ASN.1 Encoding Two vulnerabilities, CVE-2025-58185 and CVE-2025-58186, were published on October 29, 2025. CVE-2025-58185 affects the parsing of DER payloads in encoding/asn1, while CVE-2025-58186 involves a lack of limit when parsing cookies in net/http, both leading to potential memory exhaustion. Affected systems may experience performance issues due to these vulnerabilities. 2 sources 39