CVE-2025-61723 Details
Description
The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs.
A vulnerability exists in the Go programming language's encoding/pem package, specifically in versions prior to 1.24.8 and from 1.25.0 before 1.25.2. The issue arises from the PEM parsing function, which can exhibit quadratic time complexity when processing certain invalid inputs. This non-linear scaling can lead to excessive CPU consumption, particularly in programs that handle untrusted PEM data.
Users can upgrade to Go versions 1.24.8 or 1.25.2, both of which include the necessary fix. Instructions for downloading these versions are available on the Go website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Oct 30, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2025/10/08/1 | CVE | Mailing ListThird Party Advisory |
| https://go.dev/cl/709858 | [email protected] | Patch |
| https://go.dev/issue/75676 | [email protected] | Issue Tracking |
| https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI | [email protected] | Mailing ListRelease Notes |
| https://pkg.go.dev/vuln/GO-2025-4009 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| golang go | < 1.24.8 >= 1.25.0, < 1.25.2 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 29, 2026 | Initial Analysis | [email protected] |
| Nov 4, 2025 | CVE Modified | CVE |
| Nov 3, 2025 | CVE Modified | CISA-ADP |
| Oct 30, 2025 | CVE Modified | CISA-ADP |
| Oct 29, 2025 | New CVE Received | [email protected] |