CVEvulnerability
CVE-2025-61729
7.5 HIGH
Official page ↗
- Status
- Analyzed
- Published
- 2025-12-02
- Last modified
- 2026-10-18
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-295
Description
Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.
Affected configurations
• golang go (< 1.24.11)
• golang go (>= 1.25.0 < 1.25.5)
Related
Weakness · CWE (1)
- CWE-295 Improper Certificate Validation weakness
References
- https://go.dev/cl/725920 Patch
- https://go.dev/issue/76445 Issue Tracking, Patch
- https://groups.google.com/g/golang-announce/c/8FJoBkPddm4 Mailing List, Release Notes
- https://pkg.go.dev/vuln/GO-2025-4155 Vendor Advisory