p PatchFirst

CVE-2025-61729

CVE-2025-61729 · Excessive resource consumption when printing error string for host certificate validation in crypto/x509

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.

CVSS 7.5 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • crypto/x509

    Versions
    • ≥ 0, < 1.24.11: Affected (semver)
    • ≥ 1.25.0, < 1.25.5: Affected (semver)

    Update to 1.24.11; Update to 1.25.5

  • golang-1.19 Debian:12

    Versions
    • 1.19.10-1
    • 1.19.10-2
    • 1.19.11-1
    • 1.19.12-1
    • 1.19.12-2
    • 1.19.12-2~bpo11+1
    • 1.19.12-2~bpo12+1
    • 1.19.13-1
    • 1.19.13-1~bpo11+1
    • 1.19.13-1~bpo12+1
    • 1.19.8-2
    • 1.19.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.24 Debian:13

    Versions
    • 1.24.12-1
    • 1.24.13-1
    • 1.24.13-2
    • 1.24.4-1
    • 1.24.4-2
    • 1.24.4-3
    • 1.24.4-4
    • 1.24.7-1
    • 1.24.8-1
    • 1.24.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.24 Ubuntu:22.04:LTS

    Versions
    • 1.24.4-1ubuntu1~22.04.1
    • 1.24.4-1ubuntu1~22.04.2
    • 1.24.13-2~22.04.1
    • 1.24.13-2~22.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.25 Ubuntu:22.04:LTS

    Versions
    • 1.25.14-1~ubuntu0.22.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.24 Ubuntu:24.04:LTS

    Versions
    • 1.24.4-1ubuntu1~24.04.1
    • 1.24.4-1ubuntu1~24.04.2
    • 1.24.13-2~24.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.25 Ubuntu:24.04:LTS

    Versions
    • 1.25.14-1~ubuntu0.24.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.24 Ubuntu:25.10

    Versions
    • 1.24.2-1
    • 1.24.2-2
    • 1.24.4-1
    • 1.24.4-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.25 Ubuntu:25.10

    Versions
    • 1.25.0-0ubuntu1
    • 1.25.7-2~25.10.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.24 Ubuntu:26.04:LTS

    Versions
    • 1.24.4-1ubuntu1
    • 1.24.9-1
    • 1.24.13-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.25 Ubuntu:26.04:LTS

    Versions
    • 1.25.0-0ubuntu1
    • 1.25.7-2
    • 1.25.14-1~ubuntu0.26.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →