CVE-2025-61723

The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://go.dev/cl/709858	Patch
https://go.dev/issue/75676	Issue Tracking
https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI	Mailing List Release Notes
https://pkg.go.dev/vuln/GO-2025-4009	Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/10/08/1	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:golang:go::::::::
	cpe:2.3:a:golang:go::::::::

History

08 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) El tiempo de procesamiento para analizar algunas entradas no válidas escala de forma no lineal con respecto al tamaño de la entrada. Esto afecta a los programas que analizan entradas PEM no confiables.

Information

Published : 2025-10-29 23:16

Updated : 2026-10-08 10:10

NVD link : CVE-2025-61723

Mitre link : CVE-2025-61723

CVE.ORG link : CVE-2025-61723

JSON object : View

Products Affected

golang

go

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2025-61723", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61723", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-30T20:35:15.752525Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@golang.org", "affectedData": [{"vendor": "Go standard library", "product": "encoding/pem", "versions": [{"status": "affected", "version": "0", "lessThan": "1.24.8", "versionType": "semver"}, {"status": "affected", "version": "1.25.0", "lessThan": "1.25.2", "versionType": "semver"}], "packageName": "encoding/pem", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "getLine"}, {"name": "Decode"}]}]}], "published": "2025-10-29T23:16:19.927", "references": [{"url": "https://go.dev/cl/709858", "tags": ["Patch"], "source": "security@golang.org"}, {"url": "https://go.dev/issue/75676", "tags": ["Issue Tracking"], "source": "security@golang.org"}, {"url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI", "tags": ["Mailing List", "Release Notes"], "source": "security@golang.org"}, {"url": "https://pkg.go.dev/vuln/GO-2025-4009", "tags": ["Vendor Advisory"], "source": "security@golang.org"}, {"url": "http://www.openwall.com/lists/oss-security/2025/10/08/1", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs."}, {"lang": "es", "value": "El tiempo de procesamiento para analizar algunas entradas no v\u00e1lidas escala de forma no lineal con respecto al tama\u00f1o de la entrada. Esto afecta a los programas que analizan entradas PEM no confiables."}], "lastModified": "2026-10-08T10:10:00.227", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E1AB9501-4F7D-4E37-BA0A-4E57B082530C", "versionEndExcluding": "1.24.8"}, {"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C196D175-EF20-476C-8C64-1B9F5C50AA2D", "versionEndExcluding": "1.25.2", "versionStartIncluding": "1.25.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@golang.org"}