CVE-2025-61729

Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://go.dev/cl/725920	Patch
https://go.dev/issue/76445	Issue Tracking Patch
https://groups.google.com/g/golang-announce/c/8FJoBkPddm4	Mailing List Release Notes
https://pkg.go.dev/vuln/GO-2025-4155	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:golang:go::::::::
	cpe:2.3:a:golang:go::::::::

History

18 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Dentro de HostnameError.Error(), al construir una cadena de error, no hay límite en el número de hosts que se imprimirán. Además, la cadena de error se construye mediante la concatenación repetida de cadenas, lo que lleva a un tiempo de ejecución cuadrático. Por lo tanto, un certificado proporcionado por un actor malicioso puede resultar en un consumo excesivo de recursos.

Information

Published : 2025-12-02 19:15

Updated : 2026-10-18 18:10

NVD link : CVE-2025-61729

Mitre link : CVE-2025-61729

CVE.ORG link : CVE-2025-61729

JSON object : View

Products Affected

golang

go

CWE

CWE-295

Improper Certificate Validation

{"id": "CVE-2025-61729", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61729", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-02T21:52:36.341575Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@golang.org", "affectedData": [{"vendor": "Go standard library", "product": "crypto/x509", "versions": [{"status": "affected", "version": "0", "lessThan": "1.24.11", "versionType": "semver"}, {"status": "affected", "version": "1.25.0", "lessThan": "1.25.5", "versionType": "semver"}], "packageName": "crypto/x509", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "Certificate.VerifyHostname"}, {"name": "Certificate.Verify"}]}]}], "published": "2025-12-02T19:15:51.447", "references": [{"url": "https://go.dev/cl/725920", "tags": ["Patch"], "source": "security@golang.org"}, {"url": "https://go.dev/issue/76445", "tags": ["Issue Tracking", "Patch"], "source": "security@golang.org"}, {"url": "https://groups.google.com/g/golang-announce/c/8FJoBkPddm4", "tags": ["Mailing List", "Release Notes"], "source": "security@golang.org"}, {"url": "https://pkg.go.dev/vuln/GO-2025-4155", "tags": ["Vendor Advisory"], "source": "security@golang.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption."}, {"lang": "es", "value": "Dentro de HostnameError.Error(), al construir una cadena de error, no hay l\u00edmite en el n\u00famero de hosts que se imprimir\u00e1n. Adem\u00e1s, la cadena de error se construye mediante la concatenaci\u00f3n repetida de cadenas, lo que lleva a un tiempo de ejecuci\u00f3n cuadr\u00e1tico. Por lo tanto, un certificado proporcionado por un actor malicioso puede resultar en un consumo excesivo de recursos."}], "lastModified": "2026-10-18T18:10:00.100", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F2E6FD2A-A487-4099-B91D-2429F286AC6D", "versionEndExcluding": "1.24.11"}, {"criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "39C03A37-B94B-46E4-B1C2-A70A870F8E53", "versionEndExcluding": "1.25.5", "versionStartIncluding": "1.25.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@golang.org"}