Case Study How Showpo Rebuilt Its API Layer for a Global Headless Migration

CVE-2025-58186 Medium · CVSS 5.3 High Impact

net/http: Memory Exhaustion via Unbounded Cookie Parsing

Exploitable

This CVE is exploitable in typical deployments. Upgrade to the fixed version as soon as possible.

Component

Go standard library (net/http)

Disclosed

Oct 8, 2025

CVSS Score

5.3

Description

Go’s net/http package does not limit the number of cookies it parses from an HTTP request, despite the 1 MB header size limit. An attacker can send a request containing a large number of minimal cookies (e.g. a=;) to cause the server to allocate a large number of cookie structs, exhausting memory. Fixed in Go 1.24.8 and Go 1.25.2.

Version summary

Community Edition

2.11.1

addresses this CVE

Affected CE versions

>= 2.0, < 2.11.1

Enterprise Edition

2.11.2

addresses this CVE

Affected EE versions

>= 2.0, < 2.11.2

Upgrade to the addressed version or later to remediate this vulnerability.

References

View CVE-2025-58186 on NVD

Stay up to date with KrakenD releases and important updates