cookie.Cookie() panics on some malformed multipart cookie names, reachable unauthenticated through /validate. It's the same parser as CVE-2026-55149; that fix bounded the part count but not these names.
At v0.48.0 (2f720ec), these panic:
<name>_1 (no of) → index out of range [1] with length 1<name>_0of1 → index out of range [-1]<name>_-1of2 → index out of range [-2]
Go's net/http recovers the panic per request, so it's a 500 rather than a crash, but the malformed names should be rejected like other parse failures. Fix in the linked PR, with a regression test.
cookie.Cookie()panics on some malformed multipart cookie names, reachable unauthenticated through/validate. It's the same parser as CVE-2026-55149; that fix bounded the part count but not these names.At v0.48.0 (
2f720ec), these panic:<name>_1(noof) →index out of range [1] with length 1<name>_0of1→index out of range [-1]<name>_-1of2→index out of range [-2]Go's net/http recovers the panic per request, so it's a 500 rather than a crash, but the malformed names should be rejected like other parse failures. Fix in the linked PR, with a regression test.