VULNERABILITY INTELLIGENCE

CVE-2025-61729

CVSS score7.5 HIGH

EPSS probability0.46%

CISA KEVNot currently listed

Published2025-12-02

Last modified2026-10-18

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.

Weakness classification

nvd@nist.gov: CWE-295

Primary references

security@golang.org — Patch
security@golang.org — Issue Tracking, Patch
security@golang.org — Mailing List, Release Notes
security@golang.org — Vendor Advisory