PT-2026-2481 · Google+2 · Go+2
Jakub Ciolek
·
Published
2025-01-01
·
Updated
2026-05-21
·
CVE-2025-61728
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Go versions prior to 1.24.12
Go versions prior to 1.25.6
Description
The Go programming language contains a flaw in the archive/zip functionality that can lead to denial-of-service. Specifically, crafted ZIP files can trigger super-linear processing and excessive consumption of memory and CPU resources when opened, potentially causing a disruption of service. This issue affects backend services and build pipelines that automatically parse ZIP content.
Recommendations
Update to Go version 1.24.12 or later.
Update to Go version 1.25.6 or later.
Exploit
Fix
DoS
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Go
Red Os
Rocky Linux