CVE-2025-61726

Published Jan 28, 2026

Last updated 3 months ago

CVSS high 7.5

Golang

AWS

Mysql

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-61726 addresses a vulnerability found in Go 1.25.6 and Go 1.24.12, specifically within the `crypto/tls` package. The issue arises because the `Config.Clone` method, when used on a `Config` object already passed to a TLS function, allows for its mutation and reuse. This can lead to problems if `Config.SessionTicketKey` has not been explicitly set or `Config.SetSessionTicketKeys` has not been called, as `crypto/tls` will then generate random session ticket keys. The vulnerability is further compounded by the fact that session resumption does not properly account for the expiration of the full certificate chain. This combination of factors allows for potential misuse of TLS configurations.

Description: The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.
Source: security@golang.org
NVD status: Analyzed
Products: go

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-770

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "21FD9368-8AB3-404B-8599-BBF64EFE3C7B",
            "versionEndExcluding": "1.24.12",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "A547E844-78D2-4B17-B7A9-73E7B503D2CE",
            "versionEndExcluding": "1.25.6",
            "versionStartIncluding": "1.25.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.