CVE-2025-61728

Exploit

EPSS 0.02%
Veröffentlicht 28.01.2026 19:30:31
Zuletzt bearbeitet 06.02.2026 18:45:10
Quelle security@golang.org
CVE-Watchlists
Login
Unerledigt
Login

Excessive CPU consumption when building archive index in archive/zip

archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 8

NVD 2 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Golang ≫ Go Version < 1.24.12

Golang ≫ Go Version >= 1.25.0 < 1.25.6

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.02%	0.051

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0	6.5	2.8	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-770 Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc

Release Notes

https://go.dev/cl/736713

Patch

https://go.dev/issue/77102

Patch

https://pkg.go.dev/vuln/GO-2026-4342

Vendor Advisory

http://www.openwall.com/lists/oss-security/2026/01/15/4

Third Party Advisory

Exploit

Mailing List