PT-2026-2481 · Google · Go

Jakub Ciolek · Published 2025-01-01 · Updated 2026-01-29 · CVE-2025-61728

Positive Technologies · (AI Summary)

Name of the Vulnerable Software and Affected Versions Go versions prior to 1.24.12 Go versions prior to 1.25.6

Description The Go programming language contains a flaw in the archive/zip functionality that can lead to denial-of-service. Specifically, crafted ZIP files can trigger super-linear processing and excessive consumption of memory and CPU resources when opened, potentially causing a disruption of service. This issue affects backend services and build pipelines that automatically parse ZIP content.

Recommendations Update to Go version 1.24.12 or later. Update to Go version 1.25.6 or later.

Related Identifiers

CVE-2025-61728

ECHO-DCEE-75BC-CD88

SUSE-SU-2026:0297-1

SUSE-SU-2026:0298-1

SUSE-SU-2026:0308-1

Affected Products

Go

References · 80

• https://osv.dev/vulnerability/UBUNTU-CVE-2025-61728 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0298-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61728 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0308-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-61728 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0297-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-61728 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-61728 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-61728 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-61728 · Vendor Advisory
• https://github.com/golang/go/issues/77102 · Note
• https://bugzilla.suse.com/1256816 · Note
• https://twitter.com/sh0dan/status/2012092248901513383 · Twitter Post
• https://bugzilla.suse.com/1254227 · Note
• https://suse.com/security/cve/CVE-2025-61730 · Note