Skip to content
OpenAdvisories
Medium ALSA-2024:3830 1 CVE

Moderate: gvisor-tap-vsock security and bug fix update

Published Jun 11, 2024 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

A replacement for libslirp and VPNKit, written in pure Go. It is based on the network stack of gVisor and is used to provide networking for podman-machine virtual machines. Compared to libslirp, gvisor-tap-vsock brings a configurable DNS server and dynamic port forwarding.

Security Fix(es):

* golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)

Fixed packages 1

ReleasePackageFixed in
AlmaLinux · 9 gvisor-tap-vsock 6:0.7.3-3.el9_4.alma.1

Vulnerabilities 1

  • Medium 6.5
    CVE-2023-45290

    Memory exhaustion in multipart form parsing in net/textproto and net/http

    When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while readi…

    Go standard library net/textproto golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

References

  • report
    https://access.redhat.com/security/cve/CVE-2023-45290
  • report
    https://bugzilla.redhat.com/2268017
  • advisory
    https://errata.almalinux.org/9/ALSA-2024-3830.html