CESS-2025-58186 — Vulnetix

CESS-2025-58186 PUBLISHED CVSS 5.3 MEDIUM

Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as "a=;", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption.

Risk Scores

CVSS 3.1

5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Timeline

Sep 30, 2025 CVE Published

Open in Interactive Console →