CVE-2025-61723: Quadratic complexity when parsing some invalid inputs in encoding/pem
Quadratic complexity when parsing some invalid inputs in encoding/pem
Other sources
The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.2.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61723?
CVE-2025-61723 has a moderate severity due to the potential denial of service risk when parsing large untrusted PEM inputs.
How do I fix CVE-2025-61723?
To fix CVE-2025-61723, upgrade to a patched version of the affected software, specifically Golang versions that address this vulnerability.
What software is affected by CVE-2025-61723?
CVE-2025-61723 affects multiple Microsoft Golang products including versions 1.18.8-10, 1.22.7-5, 1.23.12-1, 1.24.8-1, and 1.25.3-1.
What is the impact of CVE-2025-61723?
The impact of CVE-2025-61723 includes increased processing time for parsing invalid PEM inputs which could lead to denial of service.
Can CVE-2025-61723 be exploited remotely?
Yes, CVE-2025-61723 can potentially be exploited remotely if a system processes untrusted PEM inputs from an external source.