CVE-2025-61724 - Vulnerability Details - OpenCVE

The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Golang	Net

No data.

No data.

References

Link	Providers
https://go.dev/cl/709859
https://go.dev/issue/75716
https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI
https://pkg.go.dev/vuln/GO-2025-4015

History

Thu, 30 Oct 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 30 Oct 2025 14:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Golang Golang net
Vendors & Products		Golang Golang net

Wed, 29 Oct 2025 22:30:00 +0000

Type	Values Removed	Values Added
Description		The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption.
Title		Excessive CPU consumption in Reader.ReadResponse in net/textproto
References		https://go.dev/cl/709859 https://go.dev/issue/75716 https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI https://pkg.go.dev/vuln/GO-2025-4015

MITRE

Status: PUBLISHED

Assigner: Go

Published: 2025-10-29T22:10:14.609Z

Updated: 2025-10-30T14:22:16.112Z

Reserved: 2025-09-30T15:05:03.605Z

Link: CVE-2025-61724

Vulnrichment

Updated: 2025-10-30T14:21:44.140Z

NVD

Status : Awaiting Analysis

Published: 2025-10-29T23:16:20.020

Modified: 2025-10-30T15:15:41.310

Link: CVE-2025-61724

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-61724", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2025-09-30T15:05:03.605Z", "datePublished": "2025-10-29T22:10:14.609Z", "dateUpdated": "2025-10-30T14:22:16.112Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2025-10-29T22:10:14.609Z"}, "title": "Excessive CPU consumption in Reader.ReadResponse in net/textproto", "descriptions": [{"lang": "en", "value": "The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption."}], "affected": [{"vendor": "Go standard library", "product": "net/textproto", "collectionURL": "https://pkg.go.dev", "packageName": "net/textproto", "versions": [{"version": "0", "lessThan": "1.24.8", "status": "affected", "versionType": "semver"}, {"version": "1.25.0", "lessThan": "1.25.2", "status": "affected", "versionType": "semver"}], "programRoutines": [{"name": "Reader.ReadResponse"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-407: Inefficient Algorithmic Complexity"}]}], "references": [{"url": "https://go.dev/cl/709859"}, {"url": "https://go.dev/issue/75716"}, {"url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"}, {"url": "https://pkg.go.dev/vuln/GO-2025-4015"}], "credits": [{"lang": "en", "value": "Jakub Ciolek"}]}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-10-30T14:22:06.282935Z", "id": "CVE-2025-61724", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-30T14:22:16.112Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-61724", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-30T14:22:06.282935Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-30T14:21:44.140Z"}}], "cna": {"title": "Excessive CPU consumption in Reader.ReadResponse in net/textproto", "credits": [{"lang": "en", "value": "Jakub Ciolek"}], "affected": [{"vendor": "Go standard library", "product": "net/textproto", "versions": [{"status": "affected", "version": "0", "lessThan": "1.24.8", "versionType": "semver"}, {"status": "affected", "version": "1.25.0", "lessThan": "1.25.2", "versionType": "semver"}], "packageName": "net/textproto", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "Reader.ReadResponse"}]}], "references": [{"url": "https://go.dev/cl/709859"}, {"url": "https://go.dev/issue/75716"}, {"url": "https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"}, {"url": "https://pkg.go.dev/vuln/GO-2025-4015"}], "descriptions": [{"lang": "en", "value": "The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-407: Inefficient Algorithmic Complexity"}]}], "providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2025-10-29T22:10:14.609Z"}}}, "cveMetadata": {"cveId": "CVE-2025-61724", "state": "PUBLISHED", "dateUpdated": "2025-10-30T14:22:16.112Z", "dateReserved": "2025-09-30T15:05:03.605Z", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "datePublished": "2025-10-29T22:10:14.609Z", "assignerShortName": "Go"}, "dataVersion": "5.2"}