Vulnerability Description
Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Golang | Go | < 1.24.11 |
Related Weaknesses (CWE)
References
- https://go.dev/cl/725920Patch
- https://go.dev/issue/76445Issue TrackingPatch
- https://groups.google.com/g/golang-announce/c/8FJoBkPddm4Mailing ListRelease Notes
- https://pkg.go.dev/vuln/GO-2025-4155Vendor Advisory
FAQ
What is CVE-2025-61729?
CVE-2025-61729 is a vulnerability with a CVSS score of 7.5 (HIGH). Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string conc...
How severe is CVE-2025-61729?
CVE-2025-61729 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-61729?
Check the references section above for vendor advisories and patch information. Affected products include: Golang Go.