CVE-2025-61729

Published Dec 2, 2025

Last updated a month ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-61729 is a vulnerability within the `crypto/x509` package of the Go standard library. Specifically, the `HostnameError.Error()` method is susceptible to uncontrolled resource consumption. The vulnerability arises because there is no limit to the number of hosts printed when constructing an error string within `HostnameError.Error()`. Furthermore, the error string is built through repeated string concatenation, leading to quadratic runtime. A malicious actor could exploit this by providing a certificate that leads to excessive resource consumption.

Description: Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.
Source: security@golang.org
NVD status: Analyzed
Products: go

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-295

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F2E6FD2A-A487-4099-B91D-2429F286AC6D",
            "versionEndExcluding": "1.24.11"
          },
          {
            "criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "39C03A37-B94B-46E4-B1C2-A70A870F8E53",
            "versionEndExcluding": "1.25.5",
            "versionStartIncluding": "1.25.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.