PT-2026-2481 · Google+2 · Go+2

Jakub Ciolek · Published 2025-01-01 · Updated 2026-03-13 · CVE-2025-61728

Positive Technologies · (AI Summary)

CVSS v3.1

6.5

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Go versions prior to 1.24.12 Go versions prior to 1.25.6

Description The Go programming language contains a flaw in the archive/zip functionality that can lead to denial-of-service. Specifically, crafted ZIP files can trigger super-linear processing and excessive consumption of memory and CPU resources when opened, potentially causing a disruption of service. This issue affects backend services and build pipelines that automatically parse ZIP content.

Recommendations Update to Go version 1.24.12 or later. Update to Go version 1.25.6 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

ALSA-2026:2706

ALSA-2026:2708

ALSA-2026:2709

ALSA-2026:2914

ALSA-2026:2920

ALSA-2026:3188

ALSA-2026:3336

ALSA-2026:3337

ALSA-2026:3752

ALSA-2026:3753

BIT-GOLANG-2025-61728

CLEANSTART-2026-RD09851

CLEANSTART-2026-UK11127

CLEANSTART-2026-WK32717

CVE-2025-61728

ECHO-DCEE-75BC-CD88

GO-2026-4342

MGASA-2026-0035

OPENSUSE-SU-2026:10329-1

RHSA-2026:2706

RHSA-2026:2708

RHSA-2026:2709

RHSA-2026:2914

RHSA-2026:2920

RHSA-2026:3188

RHSA-2026:3192

RHSA-2026:3193

RHSA-2026:3336

RHSA-2026:3337

RHSA-2026:3469

RHSA-2026:3471

RHSA-2026:3472

RHSA-2026:3473

RHSA-2026:3489

RHSA-2026:3752

RHSA-2026:3753

RHSA-2026:3831

RHSA-2026:3833

RHSA-2026:3835

RHSA-2026:3836

RHSA-2026:3838

RHSA-2026:3851

RHSA-2026:3854

RHSA-2026:3880

SUSE-SU-2026:0297-1

SUSE-SU-2026:0298-1

SUSE-SU-2026:0308-1

Affected Products

Go

Red Os

Rocky Linux

References · 166

• 🔥 http://openwall.com/lists/oss-security/2026/01/15/4 · Exploit
• https://go.dev/cl/736713 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2026:0298-1 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2026-2708.html · Vendor Advisory
• https://go.dev/issue/77102 · Patch
• https://errata.rockylinux.org/RLSA-2026:2709 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-61728 · Security Note
• https://osv.dev/vulnerability/GO-2026-4342 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:2708 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:3753 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61728 · Security Note
• https://advisories.mageia.org/MGASA-2026-0035.html · Security Note
• https://osv.dev/vulnerability/ALSA-2026:3336 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:2706 · Vendor Advisory
• https://errata.almalinux.org/10/ALSA-2026-2706.html · Vendor Advisory