Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-41703 State: PUBLISHED Published: 2023-01-16T10:14:01.332Z Last Updated: 2025-04-08T20:33:49.417Z Vendors: Apache Software Foundation Products: Apache Superset Problem Types: SQL injection in certain query object fields Description: A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a specific database to add subqueries to the WHERE and HAVING fields referencing tables on the same database that the user should not have access to, despite the user having the feature flag "ALLOW_ADHOC_SUBQUERY" disabled (default value). This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0. Additional
abled (default value). This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/g7jjw0okxjk5y57pbbxy19ydw42kqcos
CVE ID: CVE-2022-41704 State: PUBLISHED Published: 2022-10-25T00:00:00 Last Updated: 2024-08-03T12:49:44.004Z Vendors: Apache Software Foundation Products: Apache XML Graphics Problem Types: A jar file can be loaded from svg script element Description: A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16. It is recommended to update to version 1.16. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/hplhx0o74jb7blj39fm4kw3otcnjd6xf - http://www.openwall.com/lists/oss-security/2022/10/25/2 - https://lists.debian.org/debian-lts-announce/2022/1
tcnjd6xf - http://www.openwall.com/lists/oss-security/2022/10/25/2 - https://lists.debian.org/debian-lts-announce/2022/10/msg00038.html - https://www.debian.org/security/2022/dsa-5264 - https://security.gentoo.org/glsa/202401-11
CVE ID: CVE-2022-41705 State: PUBLISHED Published: 2022-11-25T00:00:00.000Z Last Updated: 2025-04-29T14:51:54.093Z Vendors: n/a Products: Badaso Problem Types: Remote command execution Description: Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/headhunterz/ - https://github.com/uasoft-indonesia/badaso/
CVE ID: CVE-2022-41706 State: PUBLISHED Published: 2022-11-25T00:00:00.000Z Last Updated: 2025-04-29T14:50:37.587Z Vendors: n/a Products: Browsershot Problem Types: Server Side XSS Description: Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the URL protocol passed to the Browsershot::url method. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/spatie/browsershot/ - https://fluidattacks.com/advisories/eminem/
CVE ID: CVE-2022-41707 State: PUBLISHED Published: 2022-10-19T00:00:00.000Z Last Updated: 2025-05-08T20:07:33.561Z Vendors: n/a Products: relatedcode/Messenger Problem Types: Improper authorization control for web services Description: Relatedcode's Messenger version 7bcd20b allows an authenticated external attacker to access sensitive data of any user of the application. This is possible because the application exposes user data to the public. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/coldplay/ - https://github.com/relatedcode/Messenger
CVE ID: CVE-2022-41708 State: PUBLISHED Published: 2022-10-19T00:00:00.000Z Last Updated: 2025-05-08T20:06:09.780Z Vendors: n/a Products: relatedcode/Messenger Problem Types: Improper authorization control for web services Description: Relatedcode's Messenger version 7bcd20b allows an authenticated external attacker to access existing chats in the workspaces of any user of the application. This is possible because the application does not validate permissions correctly. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/relatedcode/Messenger - https://fluidattacks.com/advisories/tiesto/
CVE ID: CVE-2022-41709 State: PUBLISHED Published: 2022-10-19T00:00:00.000Z Last Updated: 2025-05-08T20:04:07.255Z Vendors: n/a Products: Markdownify Problem Types: Remote command execution (RCE) Description: Markdownify version 1.4.1 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Markdownify. This is possible because the application has the "nodeIntegration" option enabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/adams/ - https://github.com/amitmerchant1990/electron-markdownify
CVE ID: CVE-2022-41710 State: PUBLISHED Published: 2022-11-03T00:00:00.000Z Last Updated: 2025-05-05T13:26:00.910Z Vendors: n/a Products: Markdownify Problem Types: Insecure or unset HTTP headers - Content-Security-Policy Description: Markdownify version 1.4.1 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicious markdown file through Markdownify. This is possible because the application does not have a CSP policy (or at least not strict enough) and/or does not properly validate the contents of markdown files before rendering them. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://g
fore rendering them. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/amitmerchant1990/electron-markdownify - https://fluidattacks.com/advisories/noisestorm/
CVE ID: CVE-2022-41711 State: PUBLISHED Published: 2022-10-25T00:00:00.000Z Last Updated: 2025-05-07T19:32:44.015Z Vendors: n/a Products: Badaso Problem Types: Remote command execution (RCE) Description: Badaso version 2.6.0 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/harlow/ - https://github.com/uasoft-indonesia/badaso/issues/802
CVE ID: CVE-2022-41712 State: PUBLISHED Published: 2022-11-25T00:00:00.000Z Last Updated: 2025-04-29T14:41:11.195Z Vendors: n/a Products: Frappe Problem Types: Lack of data validation - Path Traversal Description: Frappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not correctly validate the information injected by the user in the import_file parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/kiniza/ - https://github.com/frappe/frappe/
CVE ID: CVE-2022-41713 State: PUBLISHED Published: 2022-11-03T00:00:00.000Z Last Updated: 2025-05-05T13:23:35.022Z Vendors: n/a Products: deep-object-diff Problem Types: Prototype Pollution Description: deep-object-diff version 1.1.0 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the '__proto__' property to be edited. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/heldens/ - https://github.com/mattphillips/deep-object-diff
CVE ID: CVE-2022-41714 State: PUBLISHED Published: 2022-11-03T00:00:00.000Z Last Updated: 2025-05-05T13:22:29.671Z Vendors: n/a Products: fastest-json-copy Problem Types: Prototype Pollution Description: fastest-json-copy version 1.0.1 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the '__proto__' property to be edited. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/guetta/ - https://github.com/streamich/fastest-json-copy
CVE ID: CVE-2022-41715 State: PUBLISHED Published: 2022-10-14T00:00:00.000Z Last Updated: 2025-02-13T16:33:07.652Z Vendors: Go standard library Products: regexp/syntax Problem Types: CWE 400: Uncontrolled Resource Consumption Description: Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use mo
each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected. Additional Analyst Notes: - CVE Program Container: References: - https://go.dev/issue/55949 - https://go.dev/cl/439356 - https://groups.google.com/g/golang-announce/c/xtuG5faxtaU - https://pkg.go.dev/vuln/GO-2022-1039 - https://security.gentoo.org/glsa/202311-09
CVE ID: CVE-2022-41716 State: PUBLISHED Published: 2022-11-02T15:28:19.574Z Last Updated: 2024-10-30T13:59:43.967Z Vendors: Go standard library Products: syscall, os/exec Problem Types: CWE-158: Improper Neutralization of Null Byte or NUL Character Description: Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" sets the variables "A=B" an
a different environment variable. For example, the environment variable string "A=B\x00C=D" sets the variables "A=B" and "C=D". Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://go.dev/issue/56284 - https://go.dev/cl/446916 - https://groups.google.com/g/golang-announce/c/mbHY1UY3BaM/m/hSpmRzk-AgAJ - https://pkg.go.dev/vuln/GO-2022-1095
CVE ID: CVE-2022-41717 State: PUBLISHED Published: 2022-12-08T19:03:53.161Z Last Updated: 2025-02-13T16:33:08.284Z Vendors: Go standard library, golang.org/x/net Products: net/http, golang.org/x/net/http2 Problem Types: CWE 400: Uncontrolled Resource Consumption Description: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection. Additional Analyst Notes: - CVE Program Container: References: - https://go.dev/issu
imately 64 MiB per open connection. Additional Analyst Notes: - CVE Program Container: References: - https://go.dev/issue/56350 - https://go.dev/cl/455717 - https://go.dev/cl/455635 - https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ - https://pkg.go.dev/vuln/GO-2022-1144 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QBKBAZBIOXZV5QCFHZNSVXULR32XJCYD/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NQGNAXK3YBPMUP3J4TECIRDHFGW37522/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PUM4DIVOLJCBK5ZDP4LJOL24GXT3YSIR/ - https://l
project.org/archives/list/package-announce@lists.fedoraproject.org/message/PUM4DIVOLJCBK5ZDP4LJOL24GXT3YSIR/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4SBIUECMLNC572P23DDOKJNKPJVX26SP/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PW3XC47AUW5J5M2ULJX7WCCL3B2ETLMT/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q52IQI754YAE4XPR4QBRWPIVZWYGZ4FS/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/56B2FFESRYYP6IY2AZ3UWXLWKZ5IYZN4/ - https://lists.fedoraproject.org/archives/list/package-announce@li
roject.org/message/56B2FFESRYYP6IY2AZ3UWXLWKZ5IYZN4/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ANIOPUXWIHVRA6CEWXCGOMX3YYS6KFHG/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WPEIZ7AMEJCZXU3FEJZMVRNHQZXX5P3I/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CY
ttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/ - https://security.gentoo.org/glsa/202311-09 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CSVIS6MTMFVBA7JPMRAUNKUOYEVSJYSB/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/ - h
s.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR/
CVE ID: CVE-2022-41718 State: REJECTED Published: N/A Last Updated: 2024-07-02T16:16:38.533Z Description: No description available.
CVE ID: CVE-2022-41719 State: PUBLISHED Published: 2022-11-10T19:57:01.274Z Last Updated: 2025-04-30T19:46:41.386Z Vendors: github.com/shamaton/msgpack/v2 Products: github.com/shamaton/msgpack/v2 Problem Types: CWE 400: Uncontrolled Resource Consumption Description: Unmarshal can panic on some inputs, possibly allowing for denial of service attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/shamaton/msgpack/issues/31 - https://github.com/shamaton/msgpack/pull/32 - https://pkg.go.dev/vuln/GO-2022-0972
CVE ID: CVE-2022-41720 State: PUBLISHED Published: 2022-12-07T16:11:18.867Z Last Updated: 2025-04-23T15:43:46.208Z Vendors: Go standard library Products: os, net/http Problem Types: CWE 22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of files rooted at a given directory. These functions permit access to Windows device files under that root. For example, os.DirFS("C:/tmp").Open("COM1") opens the COM1 device. Both os.DirFS and http.Dir only provide read-only filesystem access. In addition, on Windows, an os.DirF
he COM1 device. Both os.DirFS and http.Dir only provide read-only filesystem access. In addition, on Windows, an os.DirFS for the directory (the root of the current drive) can permit a maliciously crafted path to escape from the drive and access any path on the system. With fix applied, the behavior of os.DirFS("") has changed. Previously, an empty root was treated equivalently to "/", so os.DirFS("").Open("tmp") would open the path "/tmp". This now returns an error. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://go.dev/issue/56694 - https://go.dev/cl/455716 - https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ - https:/
ue/56694 - https://go.dev/cl/455716 - https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ - https://pkg.go.dev/vuln/GO-2022-1143
CVE ID: CVE-2022-41721 State: PUBLISHED Published: 2023-01-13T22:46:22.064Z Last Updated: 2025-04-04T14:46:17.808Z Vendors: golang.org/x/net Products: golang.org/x/net/http2/h2c Problem Types: CWE 444: Inconsistent Interpretation of HTTP Requests ("HTTP Request/Response Smuggling) Description: A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests. Additional Analyst Notes: - CVE Program Container: - CISA AD
attacker-manipulated to represent arbitrary HTTP2 requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://go.dev/issue/56352 - https://go.dev/cl/447396 - https://pkg.go.dev/vuln/GO-2023-1495 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X3H3EWQXM2XL5AGBX6UL443JEJ3GQXJN/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X5DXTLLWN6HKI5I35EUZRBISTNZJ75GP/
CVE ID: CVE-2022-41722 State: PUBLISHED Published: 2023-02-28T17:19:41.324Z Last Updated: 2025-03-07T17:58:57.055Z Vendors: Go standard library Products: path/filepath Problem Types: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") Description: A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".
attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b". Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://go.dev/issue/57274 - https://go.dev/cl/468123 - https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E - https://pkg.go.dev/vuln/GO-2023-1568
CVE ID: CVE-2022-41723 State: PUBLISHED Published: 2023-02-28T17:19:45.801Z Last Updated: 2025-05-05T16:12:28.159Z Vendors: Go standard library, golang.org/x/net Products: net/http, golang.org/x/net/http2, golang.org/x/net/http2/hpack Problem Types: CWE 400: Uncontrolled Resource Consumption Description: A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://go.dev/issue/57855 - https://go.dev/cl/468135 - https://go.dev/cl/468295 - https://groups.google.com/g/golang-announce/c/
o.dev/issue/57855 - https://go.dev/cl/468135 - https://go.dev/cl/468295 - https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E - https://pkg.go.dev/vuln/GO-2023-1571 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MA5XS5DAOJ5PKKNG5TUXKPQOFHT5VBC/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RLBQ3A7ROLEQXQLXFDLNJ7MYPKG5GULE/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGW7GE2Z32ZT47UFAQFDRQE33B7Q7LMT/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XX3IMUTZKRQ73PBZM4E2JP4BKYH4C6XE/ - htt
fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XX3IMUTZKRQ73PBZM4E2JP4BKYH4C6XE/ - https://www.couchbase.com/alerts/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/ - https://security.gentoo.org/glsa/202311-09
CVE ID: CVE-2022-41724 State: PUBLISHED Published: 2023-02-28T17:19:44.420Z Last Updated: 2025-03-07T17:57:05.605Z Vendors: Go standard library Products: crypto/tls Problem Types: CWE-400: Uncontrolled Resource Consumption Description: Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth >= RequestClie
to a non-nil value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth >= RequestClientCert). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://go.dev/issue/58001 - https://go.dev/cl/468125 - https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E - https://pkg.go.dev/vuln/GO-2023-1570 - https://security.gentoo.org/glsa/202311-09
CVE ID: CVE-2022-41725 State: PUBLISHED Published: 2023-02-28T17:19:42.989Z Last Updated: 2025-03-07T17:58:06.747Z Vendors: Go standard library Products: mime/multipart Problem Types: CWE-400: Uncontrolled Resource Consumption Description: A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. ReadForm takes a maxMemory parameter, and is documented as storing "up to maxMemory bytes +10MB (
rm, and PostFormValue. ReadForm takes a maxMemory parameter, and is documented as storing "up to maxMemory bytes +10MB (reserved for non-file parts) in memory". File parts which cannot be stored in memory are stored on disk in temporary files. The unconfigurable 10MB reserved for non-file parts is excessively large and can potentially open a denial of service vector on its own. However, ReadForm did not properly account for all memory consumed by a parsed form, such as map entry overhead, part names, and MIME headers, permitting a maliciously crafted form to consume well over 10MB. In addition, ReadForm contained no limit on the number of disk files created, permitting a relatively small req
er 10MB. In addition, ReadForm contained no limit on the number of disk files created, permitting a relatively small request body to create a large number of disk temporary files. With fix, ReadForm now properly accounts for various forms of memory overhead, and should now stay within its documented limit of 10MB + maxMemory bytes of memory consumption. Users should still be aware that this limit is high and may still be hazardous. In addition, ReadForm now creates at most one on-disk temporary file, combining multiple form parts into a single temporary file. The mime/multipart.File interface type's documentation states, "If stored on disk, the File's underlying concrete type will be an *os.