What’s Vulnerable › Vulnerabilities

CVE-2025-61729: Excessive resource consumption when printing error string for host certificate validation in crypto/x509

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-02 · updated 2026-10-18
• Weakness: CWE-295

Description

Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.

Affected products

• Go: before 1.24.11; from 1.25.0 before 1.25.5 — fixed in 1.24.11, 1.25.5

How to fix

Upgrade to a fixed version: Go 1.24.11, 1.25.5. Check the vendor advisory for mitigations.

References

• https://go.dev/cl/725920
• https://go.dev/issue/76445
• https://groups.google.com/g/golang-announce/c/8FJoBkPddm4
• https://pkg.go.dev/vuln/GO-2025-4155

Get alerted when CVE-2025-61729 or the next vulnerability affects your stack