Skip to content
OpenAdvisories
Medium RLSA-2024:3830 1 CVE

Moderate: gvisor-tap-vsock security and bug fix update

Published Jun 14, 2024 · Updated Feb 4, 2026

Ecosystem: Rocky Linux

Summary

A replacement for libslirp and VPNKit, written in pure Go. It is based on the network stack of gVisor and is used to provide networking for podman-machine virtual machines. Compared to libslirp, gvisor-tap-vsock brings a configurable DNS server and dynamic port forwarding.

Security Fix(es):

* golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 9 gvisor-tap-vsock 6:0.7.3-3.el9_4

Vulnerabilities 1

  • Medium 6.5
    CVE-2023-45290

    Memory exhaustion in multipart form parsing in net/textproto and net/http

    When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while readi…

    Go standard library net/textproto golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2268017