p PatchFirst

CVE-2025-61725

CVE-2025-61725 · Excessive CPU consumption in ParseAddress in net/mail

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption.

CVSS 7.5 · High · EPSS 0.6% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • net/mail

    Versions
    • ≥ 0, < 1.24.8: Affected (semver)
    • ≥ 1.25.0, < 1.25.2: Affected (semver)

    Update to 1.24.8; Update to 1.25.2

  • golang-1.19 Debian:12

    Versions
    • 1.19.10-1
    • 1.19.10-2
    • 1.19.11-1
    • 1.19.12-1
    • 1.19.12-2
    • 1.19.12-2~bpo11+1
    • 1.19.12-2~bpo12+1
    • 1.19.13-1
    • 1.19.13-1~bpo11+1
    • 1.19.13-1~bpo12+1
    • 1.19.8-2
    • 1.19.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.24 Debian:13

    Versions
    • 1.24.12-1
    • 1.24.13-1
    • 1.24.13-2
    • 1.24.4-1
    • 1.24.4-2
    • 1.24.4-3
    • 1.24.4-4
    • 1.24.7-1
    • 1.24.8-1
    • 1.24.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.10 Ubuntu:14.04:LTS

    Versions
    • 1.10.4-2ubuntu1~14.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.10 Ubuntu:16.04:LTS

    Versions
    • 1.10.4-2ubuntu1~16.04.1
    • 1.10.4-2ubuntu1~16.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.6 Ubuntu:16.04:LTS

    Versions
    • 1.6-0ubuntu1
    • 1.6-0ubuntu2
    • 1.6-0ubuntu3
    • 1.6-0ubuntu4
    • 1.6-0ubuntu5
    • 1.6.1-0ubuntu1
    • 1.6.2-0ubuntu5~16.04
    • 1.6.2-0ubuntu5~16.04.2
    • 1.6.2-0ubuntu5~16.04.3
    • 1.6.2-0ubuntu5~16.04.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.13 Ubuntu:Pro:16.04:LTS

    Versions
    • 1.13.8-1ubuntu1~16.04.2
    • 1.13.8-1ubuntu1~16.04.3
    • 1.13.8-1ubuntu1~16.04.3+esm2
    • 1.13.8-1ubuntu1~16.04.3+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.18 Ubuntu:Pro:16.04:LTS

    Versions
    • 1.18.1-1ubuntu1~16.04.6
    • 1.18.1-1ubuntu1~16.04.6+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.10 Ubuntu:18.04:LTS

    Versions
    • 1.10~rc1-1
    • 1.10~rc1-1ubuntu1
    • 1.10~rc1-2ubuntu1
    • 1.10~rc2-1ubuntu1
    • 1.10-1ubuntu1
    • 1.10.1-1ubuntu2
    • 1.10.4-2ubuntu1~18.04.1
    • 1.10.4-2ubuntu1~18.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.13 Ubuntu:Pro:18.04:LTS

    Versions
    • 1.13.8-1ubuntu1~18.04.2
    • 1.13.8-1ubuntu1~18.04.3
    • 1.13.8-1ubuntu1~18.04.4
    • 1.13.8-1ubuntu1~18.04.4+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.16 Ubuntu:Pro:18.04:LTS

    Versions
    • 1.16.2-0ubuntu1~18.04.2
    • 1.16.2-0ubuntu1~18.04.2+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.18 Ubuntu:Pro:18.04:LTS

    Versions
    • 1.18.1-1ubuntu1~18.04.3
    • 1.18.1-1ubuntu1~18.04.4
    • 1.18.1-1ubuntu1~18.04.4+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.8 Ubuntu:18.04:LTS

    Versions
    • 1.8.3-2ubuntu1
    • 1.8.3-2ubuntu1.18.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.9 Ubuntu:18.04:LTS

    Versions
    • 1.9.1-2ubuntu1
    • 1.9.2-1ubuntu1
    • 1.9.2-3ubuntu1
    • 1.9.3-1ubuntu1
    • 1.9.4-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.13 Ubuntu:20.04:LTS

    Versions
    • 1.13.1-1ubuntu1
    • 1.13.3-1ubuntu1
    • 1.13.4-1ubuntu1
    • 1.13.5-1ubuntu1
    • 1.13.6-1ubuntu1
    • 1.13.6-2ubuntu1
    • 1.13.7-1ubuntu1
    • 1.13.8-1ubuntu1
    • 1.13.8-1ubuntu1.1
    • 1.13.8-1ubuntu1.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.14 Ubuntu:20.04:LTS

    Versions
    • 1.14~beta1-1
    • 1.14~beta1-2
    • 1.14~rc1-1
    • 1.14-1
    • 1.14.1-1
    • 1.14.2-1
    • 1.14.2-1ubuntu1
    • 1.14.3-2ubuntu2~20.04.1
    • 1.14.3-2ubuntu2~20.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.16 Ubuntu:Pro:20.04:LTS

    Versions
    • 1.16.2-0ubuntu1~20.04
    • 1.16.2-0ubuntu1~20.04.1
    • 1.16.2-0ubuntu1~20.04.1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.18 Ubuntu:20.04:LTS

    Versions
    • 1.18.1-1ubuntu1~20.04.1
    • 1.18.1-1ubuntu1~20.04.2
    • 1.18.1-1ubuntu1~20.04.3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.20 Ubuntu:20.04:LTS

    Versions
    • 1.20.3-1ubuntu0.1~20.04
    • 1.20.3-1ubuntu0.1~20.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.21 Ubuntu:20.04:LTS

    Versions
    • 1.21.1-1~ubuntu20.04.1
    • 1.21.1-1~ubuntu20.04.2
    • 1.21.1-1~ubuntu20.04.3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.22 Ubuntu:20.04:LTS

    Versions
    • 1.22.2-2~20.04.1
    • 1.22.2-2~20.04.2
    • 1.22.2-2~20.04.3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.17 Ubuntu:22.04:LTS

    Versions
    • 1.17-1ubuntu2
    • 1.17.3-1ubuntu1
    • 1.17.3-1ubuntu2
    • 1.17.13-3ubuntu1
    • 1.17.13-3ubuntu1.2
    • 1.17.13-3ubuntu1.3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.18 Ubuntu:22.04:LTS

    Versions
    • 1.18~beta1-0ubuntu1
    • 1.18~beta2-1ubuntu1
    • 1.18~beta2-1ubuntu2
    • 1.18~rc1-1ubuntu1
    • 1.18-1ubuntu1
    • 1.18.1-1ubuntu1
    • 1.18.1-1ubuntu1.1
    • 1.18.1-1ubuntu1.2
    • 1.18.1-1ubuntu1.3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.20 Ubuntu:22.04:LTS

    Versions
    • 1.20.3-1ubuntu0.1~22.04
    • 1.20.3-1ubuntu0.1~22.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →