CVE-2025-61728: Excessive CPU consumption when building archive index in archive/zip

Analyzed

AliasesRHEA-2026:14435RHSA-2026:3851UBUNTU-CVE-2025-61728+3171 more

Published 28-01-2026Last modified 29-01-2026

Vulnerability summary

CVE-2025-61728 is a medium (CVSS 6.5) vulnerability in go standard library archive/zip. EPSS estimates a 0.74% chance of exploitation in the next 30 days, higher than 54.5% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Routine

Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.5/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.74%

0%100%

Low · -0.01 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 61 · Related 61

MGASA-2026-0035 OPENSUSE-SU-2026:10063-1 OPENSUSE-SU-2026:10064-1 OPENSUSE-SU-2026:10101-1 OPENSUSE-SU-2026:10329-1 OPENSUSE-SU-2026:20077-1+56 more

Timeline

28-01-2026
PublishedVulnerability first disclosed.
29-01-2026
Last modifiedVulnerability information updated.

Description

archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.

CVSS metrics

8 scores · 8 sources · 1 version

v3.16.5

EPSS trend

Probability

0.74%

Chance of exploitation in the next 30 days

Percentile

55%

Versus all other CVEs

30-day change

Decrease -0.01 pp

From 0.75% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

referenceUnverified
Exploit Reference (openwall.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard198 products

aactl< 0.4.12-r40
actions-runner-controllerAll versions (No fix recorded)
actions-runner-controller-fipsAll versions (No fix recorded)
ageAll versions (No fix recorded)
age-fipsAll versions (No fix recorded)

agentbeat< 9.2.4-r1
agentbeat-fips< 9.2.4-r1
amassAll versions (No fix recorded)
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fipsAll versions (No fix recorded)
amazon-cloudwatch-agent-config-downloader-fipsAll versions (No fix recorded)
amazon-cloudwatch-agent-config-translator-fipsAll versions (No fix recorded)
amazon-cloudwatch-agent-operatorAll versions (No fix recorded)
amazon-cloudwatch-agent-operator-fipsAll versions (No fix recorded)
amazon-k8s-cni-fipsAll versions (No fix recorded)
amazon-k8s-cni-init-fipsAll versions (No fix recorded)
amazon-k8s-cni-init-fips-compatAll versions (No fix recorded)
amazon-ssm-agent-ecs-exec-fipsAll versions (No fix recorded)
amazon-ssm-agent-fipsAll versions (No fix recorded)
amazon-vpc-cni-pluginsAll versions (No fix recorded)
amazon-vpc-cni-plugins-fipsAll versions (No fix recorded)
apache-exporterAll versions (No fix recorded)
apm-server-7.17< 7.17.29-r8
apm-server-8.17All versions (No fix recorded)
apm-server-8.18All versions (No fix recorded)
apm-server-8.19All versions (No fix recorded)
apm-server-9.0All versions (No fix recorded)
apm-server-9.1All versions (No fix recorded)
apm-server-fips-7.17< 7.17.29-r8
apm-server-fips-8.17All versions (No fix recorded)
apm-server-fips-8.18All versions (No fix recorded)
apm-server-fips-8.19All versions (No fix recorded)
apm-server-fips-9.0All versions (No fix recorded)
argo-cd-2.14< 2.14.21-r5
argo-cd-2.14-compat< 2.14.21-r5
argo-cd-3.0< 3.0.23-r0
argo-cd-3.0-compat< 3.0.23-r0
argo-cd-fips-2.14< 2.14.21-r5
argo-cd-fips-2.14-compat< 2.14.21-r5
argo-rollouts-fips< 1.8.3-r8
auditbeat-8.19< 8.19.10-r1
auditbeat-9.0< 9.0.8-r5
auditbeat-9.1< 9.1.10-r1
auditbeat-9.2< 9.2.4-r1
auditbeat-fips-7< 7.17.29-r9
auditbeat-fips-8.18< 8.18.8-r4
auditbeat-fips-8.19< 8.19.10-r1
auditbeat-fips-9.0< 9.0.8-r4
authserviceAll versions (No fix recorded)
authservice-fipsAll versions (No fix recorded)
aws-ebs-csi-driver-fips-1.50All versions (No fix recorded)
aws-ebs-csi-driver-fips-1.51All versions (No fix recorded)
aws-ebs-csi-driver-fips-1.52All versions (No fix recorded)
aws-ebs-csi-driver-fips-1.53All versions (No fix recorded)
aws-eks-pod-identity-agentAll versions (No fix recorded)
aws-eks-pod-identity-agent-fipsAll versions (No fix recorded)
aws-flb-cloudwatch< 1.9.4-r23
aws-flb-cloudwatch-fips< 1.9.4-r17
aws-flb-kinesis< 1.10.3-r4
aws-flb-kinesis-fips< 1.10.3-r5
aws-fsx-csi-driverAll versions (No fix recorded)
aws-iam-authenticatorAll versions (No fix recorded)
aws-iam-authenticator-fipsAll versions (No fix recorded)
aws-network-policy-agent-fipsAll versions (No fix recorded)
aws-privateca-issuerAll versions (No fix recorded)
aws-privateca-issuer-fipsAll versions (No fix recorded)
aws-signer-notation-pluginAll versions (No fix recorded)
aws-signer-notation-plugin-fipsAll versions (No fix recorded)
aws-sigv4-proxyAll versions (No fix recorded)
aws-sigv4-proxy-fipsAll versions (No fix recorded)
azcopyAll versions (No fix recorded)
azure-aad-pod-identity-mic< 1.8.17-r32
azure-aad-pod-identity-nmi< 1.8.17-r32
azure-ipamAll versions (No fix recorded)
azure-ipam-dropgzAll versions (No fix recorded)
azure-service-operatorAll versions (No fix recorded)
azure-service-operator-fipsAll versions (No fix recorded)
azure-vnet-cniAll versions (No fix recorded)
azure-workload-identity-webhookAll versions (No fix recorded)
azuredisk-csi-1.28All versions (No fix recorded)
azuredisk-csi-1.30All versions (No fix recorded)
azuredisk-csi-fips-1.29All versions (No fix recorded)
azuredisk-csi-fips-1.31All versions (No fix recorded)
azurefile-csi-1.29All versions (No fix recorded)
azurefile-csi-1.30All versions (No fix recorded)
azurefile-csi-1.31All versions (No fix recorded)
azurefile-csi-1.32All versions (No fix recorded)
azurefile-csi-1.33All versions (No fix recorded)
azurefile-csi-1.34All versions (No fix recorded)
azurefile-csi-fips-1.29All versions (No fix recorded)
azurefile-csi-fips-1.31All versions (No fix recorded)
azurefile-csi-fips-1.32All versions (No fix recorded)
azurefile-csi-fips-1.34All versions (No fix recorded)
bank-vaults-templateAll versions (No fix recorded)
bento< 1.14.1-r1
blob-csi-1.23All versions (No fix recorded)
blob-csi-1.24All versions (No fix recorded)
blob-csi-fips-1.23All versions (No fix recorded)
blob-csi-fips-1.24All versions (No fix recorded)
blob-csi-fips-1.25All versions (No fix recorded)
blobfuse2All versions (No fix recorded)
blobfuse2-fips-health-monitorAll versions (No fix recorded)
bom< 0.7.1-r4
boring-registryAll versions (No fix recorded)
boring-registry-fipsAll versions (No fix recorded)
boringssl-fips-static-2023042800-toolsAll versions (No fix recorded)
boringssl-fips-static-20240407-toolsAll versions (No fix recorded)
buildtools-buildifier-fipsAll versions (No fix recorded)
buildtools-buildozer-fipsAll versions (No fix recorded)
cadvisor-fipsAll versions (No fix recorded)
calico-apiserver-3.29< 3.29.7-r5
calico-app-policy-3.29< 3.29.7-r5
calico-app-policy-3.31All versions (No fix recorded)
calico-cni-3.29< 3.29.7-r5
calico-felix-3.29< 3.29.7-r5
calico-felix-3.31All versions (No fix recorded)
calico-key-cert-provisioner-3.29< 3.29.7-r5
calico-key-cert-provisioner-fips-3.31All versions (No fix recorded)
calico-kube-controllers-3.29< 3.29.7-r5
calico-kube-controllers-fips-3.31All versions (No fix recorded)
calico-node-3.29< 3.29.7-r5
calico-pod2daemon-3.29< 3.29.7-r5
calico-pod2daemon-fips-3.31All versions (No fix recorded)
calico-typha-client-3.29< 3.29.7-r5
calico-typha-client-fips-3.31All versions (No fix recorded)
calico-typhad-3.29< 3.29.7-r5
calico-whisker-backend-fips-3.31All versions (No fix recorded)
calicoctl-3.29< 3.29.7-r5
calicoctl-3.31All versions (No fix recorded)
calicoctl-fips-3.31All versions (No fix recorded)
capslockAll versions (No fix recorded)
cargobumpAll versions (No fix recorded)
cass-operatorAll versions (No fix recorded)
cass-operator-fipsAll versions (No fix recorded)
ceph-csi-operatorAll versions (No fix recorded)
ceph-csi-operator-fipsAll versions (No fix recorded)
cephcsiAll versions (No fix recorded)
cephcsi-fipsAll versions (No fix recorded)
cerbos-fips< 0.51.0-r0
cerbosctl-fips< 0.51.0-r0
cert-manager-acmesolver-fips-1.19All versions (No fix recorded)
cert-manager-cainjector-fips-1.19All versions (No fix recorded)
cert-manager-cmctl< 2.4.0-r2
cert-manager-cmctl-fips< 2.4.0-r2
cert-manager-controller-fips-1.19< 1.19.2-r1
cert-manager-csi-driver-fipsAll versions (No fix recorded)
cert-manager-fips-1.17< 1.17.4-r6
cert-manager-google-cas-issuerAll versions (No fix recorded)
cert-manager-istio-csrAll versions (No fix recorded)
cert-manager-istio-csr-fipsAll versions (No fix recorded)
cert-manager-openshift-routesAll versions (No fix recorded)
cert-manager-openshift-routes-fipsAll versions (No fix recorded)
cert-manager-startupapicheck-fips-1.19All versions (No fix recorded)
cert-manager-webhook-fips-1.19All versions (No fix recorded)
cert-manager-webhook-pdns-fipsAll versions (No fix recorded)
cfsslAll versions (No fix recorded)
cfssl-bundleAll versions (No fix recorded)
chaos-mesh-fips< 2.8.1-r1
chart-testingAll versions (No fix recorded)
chart-testing-fipsAll versions (No fix recorded)
chiselAll versions (No fix recorded)
chisel-fipsAll versions (No fix recorded)
cilium-certgen-0.1All versions (No fix recorded)
cilium-cli< 0.19.0-r1
cilium-envoy-1.16< 1.16.19-r1
cilium-envoy-fips-1.15< 1.15.19-r8
cilium-envoy-fips-1.16< 1.16.19-r1
cis-operator-1.2All versions (No fix recorded)
cis-operator-1.3All versions (No fix recorded)
clickhouse-operator-fips-metrics-exporterAll versions (No fix recorded)
clickhouse-operator-metrics-exporterAll versions (No fix recorded)
cloud-provider-aws-1.28-cloud-controller-managerAll versions (No fix recorded)
cloud-provider-aws-1.29-ecr-credential-providerAll versions (No fix recorded)
cloud-provider-aws-1.31-cloud-controller-managerAll versions (No fix recorded)
cloud-provider-aws-1.32-cloud-controller-managerAll versions (No fix recorded)
cloud-provider-aws-1.32-ecr-credential-providerAll versions (No fix recorded)
cloud-provider-aws-1.33-cloud-controller-managerAll versions (No fix recorded)
cloud-provider-aws-1.33-ecr-credential-providerAll versions (No fix recorded)
cloud-provider-aws-1.34-cloud-controller-managerAll versions (No fix recorded)
cloud-provider-aws-fips-1.28-ecr-credential-providerAll versions (No fix recorded)
cloud-provider-aws-fips-1.29-cloud-controller-managerAll versions (No fix recorded)
cloud-provider-aws-fips-1.29-ecr-credential-providerAll versions (No fix recorded)
cloud-provider-aws-fips-1.31-cloud-controller-managerAll versions (No fix recorded)
cloud-provider-aws-fips-1.31-ecr-credential-providerAll versions (No fix recorded)
cloud-provider-aws-fips-1.32-cloud-controller-managerAll versions (No fix recorded)
cloud-provider-aws-fips-1.32-ecr-credential-providerAll versions (No fix recorded)
cloud-provider-aws-fips-1.33-cloud-controller-managerAll versions (No fix recorded)
cloud-provider-aws-fips-1.33-ecr-credential-providerAll versions (No fix recorded)
cloud-provider-aws-fips-1.34-cloud-controller-managerAll versions (No fix recorded)
cloud-provider-aws-fips-1.34-ecr-credential-providerAll versions (No fix recorded)
cloud-provider-azure-cloud-controller-manager-1.31All versions (No fix recorded)
cloud-provider-azure-cloud-controller-manager-1.32All versions (No fix recorded)
cloud-provider-azure-cloud-controller-manager-1.33All versions (No fix recorded)
cloud-provider-azure-cloud-controller-manager-1.34All versions (No fix recorded)
cloud-provider-azure-cloud-controller-manager-fips-1.27All versions (No fix recorded)
cloud-provider-azure-cloud-controller-manager-fips-1.28All versions (No fix recorded)
cloud-provider-azure-cloud-controller-manager-fips-1.29All versions (No fix recorded)
cloud-provider-azure-cloud-controller-manager-fips-1.30All versions (No fix recorded)
cloud-provider-azure-cloud-controller-manager-fips-1.31All versions (No fix recorded)

Show all 198

Alpine2 products

go≥ 1.25.0, < 1.24.12-r0 | ≥ 1.25.0, < 1.25.6-r0
opentofu< 1.11.4-r0

2 vendors · 200 products · Showing 200 of 1965

References

21 links

go.dev/cl/736713ARTICLEWEBFIXPatch
go.dev/issue/77102ARTICLEWEBREPORTPatch
groups.google.com/g/golang-announce/c/Vd2tYVM8eUcARTICLEREPORTWEBRelease Notes
pkg.go.dev/vuln/GO-2026-4342AdvisoryWEBVendor Advisory
www.openwall.com/lists/oss-security/2026/01/15/4WEBExploitMailing ListThird Party Advisory
access.redhat.com/errata/RHEA-2026:14435Advisory
issues.redhat.com/browse/EDM-3813ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2026/rhea-2026_14435.jsonAdvisory
access.redhat.com/security/cve/CVE-2025-61728REPORT
bugzilla.redhat.com/show_bug.cgi?id=2434431REPORT

Show all 21 references

www.cve.org/CVERecord?id=CVE-2025-61728AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2025-61728AdvisoryOval
access.redhat.com/errata/RHSA-2026:3851Advisory
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_3851.jsonAdvisory
ubuntu.com/security/CVE-2025-61728REPORT
github.com/golang/go/issues/77102REPORT
security-tracker.debian.org/tracker/CVE-2025-61728Advisory
pkg.go.devWEB
github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61728.jsonAdvisory
security.alpinelinux.org/vuln/CVE-2025-61728Advisory