CVE-2025-61729
Vulnerability Summary
Timeline
Description
Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.
CVSS Metrics
- v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Trends
Current EPSS score: 0.46%• Percentile: 39%
Techniques & Countermeasures
- CWE-295•Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
Affected Systems
- chainguard•aactl
< 0.4.12-r39
- chainguard•actions-runner-controller
< 0.13.0-r3
- chainguard•actions-runner-controller-compat
< 0.13.0-r3
- chainguard•actions-runner-controller-fips
< 0.13.0-r4
- chainguard•actions-runner-controller-fips-compat
< 0.13.0-r4
- chainguard•addon-resizer-fips
< 1.8.23-r12
- chainguard•addon-resizer-fips-compat
< 1.8.23-r12
- chainguard•age-fips
< 1.2.1-r11
- chainguard•amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fips
< 1.300062.0-r2
- chainguard•amazon-cloudwatch-agent-config-downloader-fips
< 1.300062.0-r2
- chainguard•amazon-cloudwatch-agent-config-translator-fips
< 1.300062.0-r2
- chainguard•amazon-cloudwatch-agent-fips
< 1.300062.0-r2
- chainguard•amazon-cloudwatch-agent-operator-fips
< 3.3.0-r3
- chainguard•amazon-cloudwatch-agent-operator-fips-compat
< 3.3.0-r3
- chainguard•amazon-cloudwatch-agent-start-amazon-cloudwatch-agent-fips
< 1.300062.0-r2
- chainguard•amazon-k8s-cni-fips
< 1.20.5-r1
- chainguard•amazon-k8s-cni-init-fips
< 1.20.5-r1
- chainguard•amazon-k8s-cni-init-fips-compat
< 1.20.5-r1
- chainguard•amazon-ssm-agent-ecs-exec-fips
< 3.3.3270.0-r3
- chainguard•amazon-ssm-agent-fips
< 3.3.3270.0-r3
- chainguard•amazon-vpc-cni-plugins-fips
< 1.3_git20251112-r2
- chainguard•ansible-operator
< 1.42.0-r2
- chainguard•apache-beam-java-11-sdk
< 2.69.0-r1
- chainguard•apache-beam-java-17-sdk
< 2.69.0-r1
- chainguard•apache-beam-java-21-sdk
< 2.69.0-r1
- chainguard•apache-beam-java-sdk
< 2.69.0-r1
- chainguard•apache-exporter
< 1.0.11-r2
- chainguard•apisix-ingress-controller
< 1.8.4-r6
- chainguard•apisix-ingress-controller-compat
< 1.8.4-r6
- chainguard•apisix-ingress-controller-iamguarded-compat
< 1.8.4-r6
- chainguard•apm-server-fips-7.17
< 7.17.29-r7
- chainguard•apm-server-fips-7.17-compat
< 7.17.29-r7
- chainguard•apm-server-fips-8.17
< 8.17.10-r3
- chainguard•apm-server-fips-8.17-compat
< 8.17.10-r3
- chainguard•apm-server-fips-8.18
< 8.18.8-r2
- chainguard•apm-server-fips-8.18-compat
< 8.18.8-r2
- chainguard•apm-server-fips-8.19
< 8.19.8-r1
- chainguard•apm-server-fips-8.19-compat
< 8.19.8-r1
- chainguard•apm-server-fips-9.1
< 9.1.8-r1
- chainguard•apm-server-fips-9.1-compat
< 9.1.8-r1
- chainguard•apm-server-fips-9.2
< 9.2.2-r1
- chainguard•argo-cd-fips-3.0
< 3.0.20-r7
- chainguard•argo-cd-fips-3.0-compat
< 3.0.20-r7
- chainguard•argo-cd-fips-3.0-iamguarded-compat
< 3.0.20-r7
- chainguard•argo-cd-fips-3.0-repo-server
< 3.0.20-r7
- chainguard•argo-cd-fips-3.1
< 3.1.9-r7
- chainguard•argo-cd-fips-3.1-compat
< 3.1.9-r7
- chainguard•argo-cd-fips-3.1-iamguarded-compat
< 3.1.9-r7
- chainguard•argo-cd-fips-3.1-repo-server
< 3.1.9-r7
- chainguard•argo-cd-fips-3.2
< 3.2.1-r1
Showing first 50 affected entries in server-rendered view.
References (60)
- https://go.dev/cl/725920
- https://go.dev/issue/76445
- https://groups.google.com/g/golang-announce/c/8FJoBkPddm4
- https://pkg.go.dev/vuln/GO-2025-4155
- https://access.redhat.com/errata/RHSA-2026:0921
- https://access.redhat.com/security/updates/classification/#important
- https://bugzilla.redhat.com/show_bug.cgi?id=2418462
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0921.json
- https://access.redhat.com/security/cve/CVE-2025-61729
- https://www.cve.org/CVERecord?id=CVE-2025-61729
- https://nvd.nist.gov/vuln/detail/CVE-2025-61729
- https://access.redhat.com/errata/RHSA-2026:0922
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0922.json
- https://access.redhat.com/errata/RHSA-2026:0923
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0923.json
- https://access.redhat.com/errata/RHSA-2026:1344
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1344.json
- https://access.redhat.com/errata/RHSA-2026:1518
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1518.json
- https://access.redhat.com/errata/RHSA-2026:1715
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1715.json
- https://access.redhat.com/errata/RHSA-2026:1813
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1813.json
- https://access.redhat.com/errata/RHSA-2026:1814
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1814.json
- https://access.redhat.com/errata/RHSA-2026:1907
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1907.json
- https://access.redhat.com/errata/RHSA-2026:1908
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1908.json
- https://access.redhat.com/errata/RHSA-2026:2124
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2124.json
- https://access.redhat.com/errata/RHSA-2026:2217
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2217.json
- https://access.redhat.com/errata/RHSA-2026:2218
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2218.json
- https://access.redhat.com/errata/RHSA-2026:2219
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2219.json
- https://access.redhat.com/errata/RHSA-2026:2223
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2223.json
- https://access.redhat.com/errata/RHSA-2026:2265
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2265.json
- https://access.redhat.com/errata/RHSA-2026:2320
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2320.json
- https://access.redhat.com/errata/RHSA-2026:2323
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2323.json
- https://access.redhat.com/errata/RHSA-2026:2334
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2334.json
- https://access.redhat.com/errata/RHSA-2026:2441
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2441.json
- https://access.redhat.com/errata/RHSA-2026:3053
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_3053.json
- https://access.redhat.com/errata/RHSA-2026:3287
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_3287.json
- https://access.redhat.com/errata/RHSA-2026:3288
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_3288.json
- https://access.redhat.com/errata/RHSA-2026:3289
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_3289.json
- https://security-tracker.debian.org/tracker/CVE-2025-61729
- https://pkg.go.dev
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61729.json