CVE-2025-61729: Excessive resource consumption when printing error string for host certificate validation in crypto/x509
Excessive resource consumption when printing error string for host certificate validation in crypto/x509
Other sources
Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
golangto a version that resolves this vulnerability.Fixed in 1.25.5Patch CVE-2025-61729 - Upgrade
Upgrade
golangto a version that resolves this vulnerability.Fixed in 1.24.11Patch CVE-2025-61727
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61729?
The severity of CVE-2025-61729 has not been officially rated, but it involves excessive resource consumption due to unbounded error string generation.
How do I fix CVE-2025-61729?
To fix CVE-2025-61729, update to a patched version of Go that limits the number of hosts printed in error strings.
Which software versions are affected by CVE-2025-61729?
CVE-2025-61729 affects multiple versions of Go from 1.24.11 to 1.25.5 and specific Microsoft products utilizing Go.
What type of vulnerability is CVE-2025-61729?
CVE-2025-61729 is classified as a resource consumption vulnerability due to excessive handling of error strings.
Can CVE-2025-61729 impact application performance?
Yes, CVE-2025-61729 can significantly impact application performance by consuming excessive resources during error handling.