CVE-2025-61728

Description

archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.

CVSS Metrics

• v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.68%• Percentile: 51%

Techniques & Countermeasures

• CWE-770•Allocation of Resources Without Limits or Throttling

  The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected Systems

• chainguard•aactl

  < 0.4.12-r40

• chainguard•actions-runner-controller

  < 0

• chainguard•actions-runner-controller-fips

  < 0

• chainguard•age

  < 0

• chainguard•age-fips

  < 0

• chainguard•agentbeat

  < 9.2.4-r1

• chainguard•agentbeat-fips

  < 9.2.4-r1

• chainguard•amass

  < 0

• chainguard•amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fips

  < 0

• chainguard•amazon-cloudwatch-agent-config-downloader-fips

  < 0

• chainguard•amazon-cloudwatch-agent-config-translator-fips

  < 0

• chainguard•amazon-cloudwatch-agent-operator

  < 0

• chainguard•amazon-cloudwatch-agent-operator-fips

  < 0

• chainguard•amazon-k8s-cni-fips

  < 0

• chainguard•amazon-k8s-cni-init-fips

  < 0

• chainguard•amazon-k8s-cni-init-fips-compat

  < 0

• chainguard•amazon-ssm-agent-ecs-exec-fips

  < 0

• chainguard•amazon-ssm-agent-fips

  < 0

• chainguard•amazon-vpc-cni-plugins

  < 0

• chainguard•amazon-vpc-cni-plugins-fips

  < 0

• chainguard•apache-exporter

  < 0

• chainguard•apm-server-7.17

  < 7.17.29-r8

• chainguard•apm-server-8.17

  < 0

• chainguard•apm-server-8.18

  < 0

• chainguard•apm-server-8.19

  < 0

• chainguard•apm-server-9.0

  < 0

• chainguard•apm-server-9.1

  < 0

• chainguard•apm-server-fips-7.17

  < 7.17.29-r8

• chainguard•apm-server-fips-8.17

  < 0

• chainguard•apm-server-fips-8.18

  < 0

• chainguard•apm-server-fips-8.19

  < 0

• chainguard•apm-server-fips-9.0

  < 0

• chainguard•argo-cd-2.14

  < 2.14.21-r5

• chainguard•argo-cd-2.14-compat

  < 2.14.21-r5

• chainguard•argo-cd-3.0

  < 3.0.23-r0

• chainguard•argo-cd-3.0-compat

  < 3.0.23-r0

• chainguard•argo-cd-fips-2.14

  < 2.14.21-r5

• chainguard•argo-cd-fips-2.14-compat

  < 2.14.21-r5

• chainguard•argo-rollouts-fips

  < 1.8.3-r8

• chainguard•auditbeat-8.19

  < 8.19.10-r1

• chainguard•auditbeat-9.0

  < 9.0.8-r5

• chainguard•auditbeat-9.1

  < 9.1.10-r1

• chainguard•auditbeat-9.2

  < 9.2.4-r1

• chainguard•auditbeat-fips-7

  < 7.17.29-r9

• chainguard•auditbeat-fips-8.18

  < 8.18.8-r4

• chainguard•auditbeat-fips-8.19

  < 8.19.10-r1

• chainguard•auditbeat-fips-9.0

  < 9.0.8-r4

• chainguard•authservice

  < 0

• chainguard•authservice-fips

  < 0

• chainguard•aws-ebs-csi-driver-fips-1.50

  < 0

Showing first 50 affected entries in server-rendered view.

References (18)

• https://go.dev/cl/736713
• https://go.dev/issue/77102
• https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc
• https://pkg.go.dev/vuln/GO-2026-4342
• http://www.openwall.com/lists/oss-security/2026/01/15/4
• https://access.redhat.com/errata/RHEA-2026:14435
• https://issues.redhat.com/browse/EDM-3813
• https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhea-2026_14435.json
• https://access.redhat.com/security/cve/CVE-2025-61728
• https://bugzilla.redhat.com/show_bug.cgi?id=2434431
• https://www.cve.org/CVERecord?id=CVE-2025-61728
• https://nvd.nist.gov/vuln/detail/CVE-2025-61728
• https://access.redhat.com/errata/RHSA-2026:3851
• https://access.redhat.com/security/updates/classification/#moderate
• https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_3851.json
• https://security-tracker.debian.org/tracker/CVE-2025-61728
• https://pkg.go.dev
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61728.json