CVE-2025-61724

The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://go.dev/cl/709859	Patch
https://go.dev/issue/75716	Issue Tracking
https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI	Mailing List Release Notes
https://pkg.go.dev/vuln/GO-2025-4015	Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/10/08/1	Mailing List Release Notes Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:golang:go::::::::
	cpe:2.3:a:golang:go::::::::

History

08 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) La función Reader.ReadResponse construye una cadena de respuesta mediante la concatenación repetida de cadenas de líneas. Cuando el número de líneas en una respuesta es grande, esto puede causar un consumo excesivo de CPU.

Information

Published : 2025-10-29 23:16

Updated : 2026-10-08 10:10

NVD link : CVE-2025-61724

Mitre link : CVE-2025-61724

CVE.ORG link : CVE-2025-61724

JSON object : View

Products Affected

golang

go

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2025-61724", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61724", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-30T14:22:06.282935Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@golang.org", "affectedData": [{"vendor": "Go standard library", "product": "net/textproto", "versions": [{"status": "affected", "version": "0", "lessThan": "1.24.8", "versionType": "semver"}, {"status": "affected", "version": "1.25.0", "lessThan": "1.25.2", "versionType": "semver"}], "packageName": "net/textproto", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "Reader.ReadResponse"}]}]}], "published": "2025-10-29T23:16:20.020", "references": [{"url": "https://go.dev/cl/709859", "tags": ["Patch"], "source": "security@golang.org"}, {"url": "https://go.dev/issue/75716", "tags": ["Issue Tracking"], "source": "security@golang.org"}, {"url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI", "tags": ["Mailing List", "Release Notes"], "source": "security@golang.org"}, {"url": "https://pkg.go.dev/vuln/GO-2025-4015", "tags": ["Vendor Advisory"], "source": "security@golang.org"}, {"url": "http://www.openwall.com/lists/oss-security/2025/10/08/1", "tags": ["Mailing List", "Release Notes", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption."}, {"lang": "es", "value": "La funci\u00f3n Reader.ReadResponse construye una cadena de respuesta mediante la concatenaci\u00f3n repetida de cadenas de l\u00edneas. Cuando el n\u00famero de l\u00edneas en una respuesta es grande, esto puede causar un consumo excesivo de CPU."}], "lastModified": "2026-10-08T10:10:00.227", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E1AB9501-4F7D-4E37-BA0A-4E57B082530C", "versionEndExcluding": "1.24.8"}, {"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C196D175-EF20-476C-8C64-1B9F5C50AA2D", "versionEndExcluding": "1.25.2", "versionStartIncluding": "1.25.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@golang.org"}