CVE-2025-61725: go standard library net/mail

CVSS: 7.5v3.1HighDeferred

AliasesUBUNTU-CVE-2025-61725DEBIAN-CVE-2025-61725CGA-22h5-8h42-pv6r+3954 more

Published 29-10-2025Last modified 09-12-2025

Vulnerability summary

CVE-2025-61725 is a high (CVSS 7.5) vulnerability in go standard library net/mail. EPSS estimates a 0.65% chance of exploitation in the next 30 days, higher than 50.1% of scored vulnerabilities.

Overall risk

30/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

0.65%

0%100%

Low · +0.04 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 22 · Related 94

MGASA-2025-0256 OPENSUSE-SU-2025:15608-1 OPENSUSE-SU-2025:15609-1 OPENSUSE-SU-2025:15695-1 OPENSUSE-SU-2025:20157-1 OPENSUSE-SU-2025:20158-1+89 more

Timeline

29-10-2025
PublishedVulnerability first disclosed.
09-12-2025
Last modifiedVulnerability information updated.

Description

The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption.

CVSS metrics

4 scores · 4 sources · 1 version

v3.17.5

EPSS trend

Probability

0.65%

Chance of exploitation in the next 30 days

Percentile

50%

Versus all other CVEs

30-day change

+0.04 pp

From 0.60% on 20-09-2026

20-09-202620-10-2026

EPSS score

0.65%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Chainguard200 products

age< 1.2.1-r8
age-fips< 1.2.1-r8
amass< 5.0.1-r1
amazon-k8s-cni-fips< 1.20.4-r2
amazon-k8s-cni-init-fips< 1.20.4-r2

amazon-k8s-cni-init-fips-compat< 1.20.4-r2
ansible-operator< 1.41.0-r1
ansible-operator-compat< 1.41.0-r1
apisix-ingress-controller< 1.8.4-r4
apisix-ingress-controller-compat< 1.8.4-r4
apisix-ingress-controller-iamguarded-compat< 1.8.4-r4
apm-server-7.17< 7.17.29-r4
apm-server-7.17-compat< 7.17.29-r4
apm-server-8.17< 8.17.10-r2
apm-server-8.17-compat< 8.17.10-r2
apm-server-8.18< 8.18.8-r1
apm-server-8.18-compat< 8.18.8-r1
apm-server-fips-7.17< 7.17.29-r4
apm-server-fips-7.17-compat< 7.17.29-r4
apm-server-fips-8.17< 8.17.10-r1
apm-server-fips-8.17-compat< 8.17.10-r1
apm-server-fips-8.18< 8.18.8-r1
apm-server-fips-8.18-compat< 8.18.8-r1
apm-server-fips-9.0< 9.0.8-r1
apm-server-fips-9.0-compat< 9.0.8-r1
argo-cd-2.13-compat< 2.13.9-r2
argo-rollouts< 1.8.3-r4
argo-rollouts-fips< 1.8.3-r5
atlantis< 0.36.0-r2
auditbeat-fips-8.17< 8.17.10-r2
auditbeat-fips-8.18< 8.18.8-r2
auditbeat-fips-9.0< 9.0.8-r2
authservice-fips< 1.1.1-r1
authservice-fips-compat< 1.1.1-r1
aws-iam-authenticator< 0.7.8-r1
aws-iam-authenticator-fips< 0.7.8-r1
aws-node-termination-handler< 1.25.2-r2
aws-node-termination-handler-compat< 1.25.2-r2
aws-node-termination-handler-fips< 1.25.2-r2
aws-node-termination-handler-fips-compat< 1.25.2-r2
aws-privateca-issuer-compat-fips< 1.7.0-r3
aws-privateca-issuer-fips< 1.7.0-r3
aws-s3-controller< 1.1.1-r1
aws-signer-notation-plugin< 1.0.2292-r3
aws-signer-notation-plugin-fips< 1.0.2292-r3
aws-sigv4-proxy< 1.10-r3
aws-sigv4-proxy-compat< 1.10-r3
aws-sigv4-proxy-fips< 1.10-r3
aws-sigv4-proxy-fips-compat< 1.10-r3
azure-aad-pod-identity-mic< 1.8.17-r28
azure-aad-pod-identity-nmi< 1.8.17-r28
azure-container-networking< 1.7.4-r1
azure-ipam< 0.4.0-r4
azure-ipam-dropgz< 0.4.0-r4
azure-vnet-cni< 1.7.4-r1
azure-workload-identity-webhook< 1.5.1-r3
azure-workload-identity-webhook-compat< 1.5.1-r3
azuredisk-csi-fips-1.33< 1.33.5-r1
azurefile-csi-1.30< 1.30.10-r5
azurefile-csi-1.30-compat< 1.30.10-r5
azurefile-csi-1.31< 1.31.8-r1
azurefile-csi-1.31-compat< 1.31.8-r1
azurefile-csi-1.32< 1.32.7-r1
azurefile-csi-1.32-compat< 1.32.7-r1
azurefile-csi-1.33< 1.33.5-r1
azurefile-csi-1.33-compat< 1.33.5-r1
azurefile-csi-fips-1.29< 1.29.12-r5
azurefile-csi-fips-1.29-compat< 1.29.12-r5
azurefile-csi-fips-1.30< 1.30.10-r5
azurefile-csi-fips-1.30-compat< 1.30.10-r5
azurefile-csi-fips-1.31< 1.31.8-r1
azurefile-csi-fips-1.31-compat< 1.31.8-r1
azurefile-csi-fips-1.32< 1.32.7-r1
azurefile-csi-fips-1.32-compat< 1.32.7-r1
bazelisk< 1.27.0-r1
bazelisk-default< 1.27.0-r1
beats-fips-8.17< 8.17.10-r2
beats-fips-8.18< 8.18.8-r2
beats-fips-9.0< 9.0.8-r2
blob-csi-1.23< 1.23.11-r56
blob-csi-1.23-compat< 1.23.11-r56
blob-csi-1.24< 1.24.11-r5
blob-csi-1.24-compat< 1.24.11-r5
blob-csi-1.25< 1.25.10-r1
blob-csi-1.25-compat< 1.25.10-r1
blob-csi-fips-1.23< 1.23.11-r57
blob-csi-fips-1.23-compat< 1.23.11-r57
blob-csi-fips-1.24< 1.24.11-r5
blob-csi-fips-1.24-compat< 1.24.11-r5
blob-csi-fips-1.25< 1.25.10-r1
blob-csi-fips-1.25-compat< 1.25.10-r1
blob-csi-fips-1.26< 1.26.7-r3
blob-csi-fips-1.26-compat< 1.26.7-r3
blobfuse2-fips< 2.4.2-r6
blobfuse2-fips-health-monitor< 2.4.2-r6
blobfuse2-fips-syslog< 2.4.2-r6
bom< 0.7.1-r1
boring-registry< 0.16.6-r2
boring-registry-fips< 0.16.6-r2
cadvisor< 0.53.0-r6
cadvisor-compat< 0.53.0-r6
calico-3.29< 3.29.6-r1
calico-apiserver-3.29< 3.29.6-r1
calico-apiserver-compat-3.29< 3.29.6-r1
calico-app-policy-3.29< 3.29.6-r1
calico-cni-3.29< 3.29.6-r1
calico-cni-compat-3.29< 3.29.6-r1
calico-felix-3.29< 3.29.6-r1
calico-key-cert-provisioner-3.29< 3.29.6-r1
calico-kube-controllers-3.29< 3.29.6-r1
calico-node-3.29< 3.29.6-r1
calico-pod2daemon-3.29< 3.29.6-r1
calico-pod2daemon-flexvol-compat-3.29< 3.29.6-r1
calico-typha-client-3.29< 3.29.6-r1
calico-typhad-3.29< 3.29.6-r1
calicoctl-3.29< 3.29.6-r1
capslock< 0.2.8-r1
cargobump< 0.1.0-r7
cephcsi-fips< 3.15.0-r3
cert-exporter< 2.16.0-r2
cert-exporter-fips< 2.16.0-r3
cert-manager-cmctl< 2.3.0-r5
cert-manager-webhook-pdns< 2.5.3-r1
cert-manager-webhook-pdns-fips< 2.5.3-r2
certificate-transparency< 1.3.2-r4
certificate-transparency-trillian-ctserver< 1.3.2-r4
cfssl< 1.6.5-r23
cfssl-bundle< 1.6.5-r23
cfssl-bundle-fips< 1.6.5-r16
cfssl-certinfo< 1.6.5-r23
cfssl-certinfo-fips< 1.6.5-r16
cfssl-fips< 1.6.5-r16
cfssl-json< 1.6.5-r23
cfssl-json-fips< 1.6.5-r16
cfssl-mkbundle< 1.6.5-r23
cfssl-mkbundle-fips< 1.6.5-r16
cfssl-multirootca< 1.6.5-r23
cfssl-multirootca-fips< 1.6.5-r16
cfssl-newkey< 1.6.5-r23
cfssl-newkey-fips< 1.6.5-r16
cfssl-scan< 1.6.5-r23
cfssl-scan-fips< 1.6.5-r16
chartmuseum< 0.16.3-r8
chartmuseum-fips< 0.16.3-r6
checksec< 3.0.2-r6
chisel< 1.11.3-r1
chisel-compat< 1.11.3-r1
chisel-fips< 1.11.3-r1
cilium-1.15< 1.15.19-r3
cilium-1.15-clustermesh-apiserver< 1.15.19-r3
cilium-1.15-container-init< 1.15.19-r3
cilium-1.15-container-init-compat< 1.15.19-r3
cilium-1.15-hubble-relay< 1.15.19-r3
cilium-1.15-iptables< 1.15.19-r3
cilium-1.15-operator-aws< 1.15.19-r3
cilium-1.15-operator-generic< 1.15.19-r3
cilium-certgen-0.2< 0.2.4-r3
cilium-envoy-fips-1.15< 1.15.19-r6
cilium-fips-1.15< 1.15.19-r7
cilium-fips-1.15-clustermesh-apiserver< 1.15.19-r7
cilium-fips-1.15-container-init< 1.15.19-r7
cilium-fips-1.15-container-init-compat< 1.15.19-r7
cilium-fips-1.15-host-utils< 1.15.19-r7
cilium-fips-1.15-hubble-relay< 1.15.19-r7
cilium-fips-1.15-operator-aws< 1.15.19-r7
cilium-fips-1.15-operator-azure< 1.15.19-r7
cilium-fips-1.15-operator-generic< 1.15.19-r7
cis-operator-1.2< 1.2.7-r5
cloud-provider-aws-1.28< 1.28.11-r40
cloud-provider-aws-1.28-cloud-controller-manager< 1.28.11-r40
cloud-provider-aws-1.28-ecr-credential-provider< 1.28.11-r40
cloud-provider-aws-1.29< 1.29.8-r40
cloud-provider-aws-1.29-cloud-controller-manager< 1.29.8-r40
cloud-provider-aws-1.29-ecr-credential-provider< 1.29.8-r40
cloud-provider-aws-fips-1.28< 1.28.11-r11
cloud-provider-aws-fips-1.28-cloud-controller-manager< 1.28.11-r11
cloud-provider-aws-fips-1.28-ecr-credential-provider< 1.28.11-r11
cloud-provider-aws-fips-1.29< 1.29.8-r11
cloud-provider-aws-fips-1.29-cloud-controller-manager< 1.29.8-r11
cloud-provider-aws-fips-1.29-ecr-credential-provider< 1.29.8-r11
cloud-provider-azure-1.27< 1.27.21-r15
cloud-provider-azure-1.28< 1.28.14-r11
cloud-provider-azure-1.29< 1.29.15-r5
cloud-provider-azure-1.30< 1.30.15-r1
cloud-provider-azure-1.31< 1.31.9-r1
cloud-provider-azure-1.33< 1.33.3-r1
cloud-provider-azure-cloud-controller-manager-1.27< 1.27.21-r15
cloud-provider-azure-cloud-controller-manager-1.27-compat< 1.27.21-r15
cloud-provider-azure-cloud-controller-manager-1.28< 1.28.14-r11
cloud-provider-azure-cloud-controller-manager-1.28-compat< 1.28.14-r11
cloud-provider-azure-cloud-controller-manager-1.29< 1.29.15-r5
cloud-provider-azure-cloud-controller-manager-1.29-compat< 1.29.15-r5
cloud-provider-azure-cloud-controller-manager-1.30< 1.30.15-r1
cloud-provider-azure-cloud-controller-manager-1.30-compat< 1.30.15-r1
cloud-provider-azure-cloud-controller-manager-1.31< 1.31.9-r1
cloud-provider-azure-cloud-controller-manager-1.31-compat< 1.31.9-r1
cloud-provider-azure-cloud-controller-manager-1.33< 1.33.3-r1
cloud-provider-azure-cloud-controller-manager-1.33-compat< 1.33.3-r1
cloud-provider-azure-cloud-controller-manager-fips-1.27< 1.27.21-r14
cloud-provider-azure-cloud-controller-manager-fips-1.28< 1.28.14-r10

Show all 200

1 vendor · 200 products · Showing 200 of 2326. Use Open JSON for the complete list.

References

12 links

Show all 12 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities