CVE-2025-61728: Excessive CPU consumption when building archive index in archive/zip
archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61728?
CVE-2025-61728 has a high-severity rating due to its potential to cause a denial of service through excessive CPU consumption.
How do I fix CVE-2025-61728?
To fix CVE-2025-61728, update to the latest version of the archive/zip library where the vulnerability has been addressed.
What causes CVE-2025-61728?
CVE-2025-61728 is caused by a super-linear file name indexing algorithm that leads to excessive CPU consumption when processing malicious ZIP archives.
What are the risks associated with CVE-2025-61728?
The risks associated with CVE-2025-61728 include potential denial of service attacks due to high CPU usage when handling specially crafted ZIP files.
Who is affected by CVE-2025-61728?
Users and applications that utilize the archive/zip library are affected by CVE-2025-61728, particularly those that open ZIP archives.