CVE-2025-61725: Excessive CPU consumption in ParseAddress in net/mail
Excessive CPU consumption in ParseAddress in net/mail
Other sources
The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.2.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61725?
CVE-2025-61725 has been classified with a moderate severity due to its potential for excessive CPU consumption.
How do I fix CVE-2025-61725?
To fix CVE-2025-61725, update your version of Google Golang to the latest release that addresses the vulnerability.
What systems are affected by CVE-2025-61725?
CVE-2025-61725 affects implementations of Google Golang that utilize the ParseAddress function for domain-literal address components.
What are the potential impacts of CVE-2025-61725?
The potential impacts of CVE-2025-61725 include high CPU consumption which can degrade system performance and responsiveness.
Is CVE-2025-61725 being actively exploited?
As of now, there have been no known active exploits reported for CVE-2025-61725, but it is important to apply the fix to mitigate risks.