CVE-2025-61729: Excessive resource consumption when printing error string for host certificate validation in crypto/x509

Analyzed

AliasesRHSA-2026:0921RHSA-2026:0922RHSA-2026:0923+4436 more

Published 02-12-2025Last modified 03-12-2025

Vulnerability summary

CVE-2025-61729 is a high (CVSS 7.5) Improper Certificate Validation vulnerability in go standard library crypto/x509. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 42.1% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

0.49%

0%100%

Low · +0.03 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 140 · Related 324

MGASA-2025-0326 MGASA-2026-0147 OPENSUSE-SU-2025:15795-1 OPENSUSE-SU-2025:15796-1 OPENSUSE-SU-2025:15807-1 OPENSUSE-SU-2025:15817-1+94 more

Showing 100 of 326.

Timeline

02-12-2025
PublishedVulnerability first disclosed.
03-12-2025
Last modifiedVulnerability information updated.

Description

Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.

CVSS metrics

8 scores · 8 sources · 1 version

v3.17.5

EPSS trend

Probability

0.49%

Chance of exploitation in the next 30 days

Percentile

42%

Versus all other CVEs

30-day change

Increase +0.03 pp

From 0.46% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-295Improper Certificate ValidationThe product does not validate, or incorrectly validates, a certificate.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard197 products

aactl< 0.4.12-r39
actions-runner-controller< 0.13.0-r3
actions-runner-controller-compat< 0.13.0-r3
actions-runner-controller-fips< 0.13.0-r4
actions-runner-controller-fips-compat< 0.13.0-r4

addon-resizer-fips< 1.8.23-r12
addon-resizer-fips-compat< 1.8.23-r12
age-fips< 1.2.1-r11
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fips< 1.300062.0-r2
amazon-cloudwatch-agent-config-downloader-fips< 1.300062.0-r2
amazon-cloudwatch-agent-config-translator-fips< 1.300062.0-r2
amazon-cloudwatch-agent-fips< 1.300062.0-r2
amazon-cloudwatch-agent-operator-fips< 3.3.0-r3
amazon-cloudwatch-agent-operator-fips-compat< 3.3.0-r3
amazon-cloudwatch-agent-start-amazon-cloudwatch-agent-fips< 1.300062.0-r2
amazon-k8s-cni-fips< 1.20.5-r1
amazon-k8s-cni-init-fips< 1.20.5-r1
amazon-k8s-cni-init-fips-compat< 1.20.5-r1
amazon-ssm-agent-ecs-exec-fips< 3.3.3270.0-r3
amazon-ssm-agent-fips< 3.3.3270.0-r3
amazon-vpc-cni-plugins-fips< 1.3_git20251112-r2
ansible-operator< 1.42.0-r2
apache-beam-java-11-sdk< 2.69.0-r1
apache-beam-java-17-sdk< 2.69.0-r1
apache-beam-java-21-sdk< 2.69.0-r1
apache-beam-java-sdk< 2.69.0-r1
apache-exporter< 1.0.11-r2
apisix-ingress-controller< 1.8.4-r6
apisix-ingress-controller-compat< 1.8.4-r6
apisix-ingress-controller-iamguarded-compat< 1.8.4-r6
apm-server-fips-7.17< 7.17.29-r7
apm-server-fips-7.17-compat< 7.17.29-r7
apm-server-fips-8.17< 8.17.10-r3
apm-server-fips-8.17-compat< 8.17.10-r3
apm-server-fips-8.18< 8.18.8-r2
apm-server-fips-8.18-compat< 8.18.8-r2
apm-server-fips-8.19< 8.19.8-r1
apm-server-fips-8.19-compat< 8.19.8-r1
apm-server-fips-9.1< 9.1.8-r1
apm-server-fips-9.1-compat< 9.1.8-r1
apm-server-fips-9.2< 9.2.2-r1
argo-cd-fips-3.0< 3.0.20-r7
argo-cd-fips-3.0-compat< 3.0.20-r7
argo-cd-fips-3.0-iamguarded-compat< 3.0.20-r7
argo-cd-fips-3.0-repo-server< 3.0.20-r7
argo-cd-fips-3.1< 3.1.9-r7
argo-cd-fips-3.1-compat< 3.1.9-r7
argo-cd-fips-3.1-iamguarded-compat< 3.1.9-r7
argo-cd-fips-3.1-repo-server< 3.1.9-r7
argo-cd-fips-3.2< 3.2.1-r1
argo-cd-fips-3.2-compat< 3.2.1-r1
argo-cd-fips-3.2-iamguarded-compat< 3.2.1-r1
argo-cd-fips-3.2-repo-server< 3.2.1-r1
argo-rollouts-fips< 1.8.3-r7
argocd-image-updater< 1.0.1-r2
argocd-image-updater-compat< 1.0.1-r2
auditbeat-7< 7.17.29-r7
auditbeat-8.17< 8.17.10-r4
auditbeat-8.17-oci-entrypoint< 8.17.10-r4
authservice-fips< 1.1.4-r1
authservice-fips-compat< 1.1.4-r1
aws-application-networking-k8s-fips< 1.1.7-r2
aws-application-networking-k8s-fips-compat< 1.1.7-r2
aws-ebs-csi-driver-fips-1.49< 1.49.2-r1
aws-ebs-csi-driver-fips-1.50< 1.50.3-r1
aws-ebs-csi-driver-fips-1.51< 1.51.2-r1
aws-ebs-csi-driver-fips-1.52< 1.52.1-r1
aws-ebs-csi-driver-fips-1.53< 1.53.0-r1
aws-efs-csi-driver-fips< 2.1.15-r1
aws-eks-pod-identity-agent-fips< 0.1.36-r1
aws-flb-cloudwatch< 1.9.4-r21
aws-flb-cloudwatch-compat-fips< 1.9.4-r15
aws-flb-cloudwatch-fips< 1.9.4-r15
aws-flb-firehose-compat-fips< 1.7.2-r16
aws-flb-firehose-fips< 1.7.2-r16
aws-iam-authenticator-fips< 0.7.9-r1
aws-load-balancer-controller< 2.16.0-r2
aws-load-balancer-controller-compat< 2.16.0-r2
aws-load-balancer-controller-fips< 2.16.0-r2
aws-network-policy-agent-compat-fips< 1.2.7-r2
aws-network-policy-agent-fips< 1.2.7-r2
aws-node-termination-handler-fips< 1.25.3-r2
aws-node-termination-handler-fips-compat< 1.25.3-r2
aws-nuke< 3.62.0-r1
aws-nuke-fips< 3.62.0-r1
aws-otel-collector-fips< 0.45.1-r3
aws-otel-collector-healthcheck-fips< 0.45.1-r3
aws-privateca-issuer< 1.7.1-r1
aws-privateca-issuer-compat< 1.7.1-r1
aws-privateca-issuer-compat-fips< 1.7.1-r1
aws-privateca-issuer-fips< 1.7.1-r1
aws-signer-notation-plugin-fips< 1.0.2292-r4
aws-sigv4-proxy-fips< 1.10-r4
aws-sigv4-proxy-fips-compat< 1.10-r4
azcopy-fips< 10.31.0-r3
azure-container-networking< 1.7.9-r1
azure-service-operator-fips< 2.17.0-r0
azure-vnet-cni< 1.7.9-r1
azuredisk-csi-fips-1.28< 1.28.12-r10
azuredisk-csi-fips-1.29< 1.29.14-r10
azuredisk-csi-fips-1.30< 1.30.12-r8
azuredisk-csi-fips-1.31< 1.31.12-r5
azuredisk-csi-fips-1.32< 1.32.11-r5
azuredisk-csi-fips-1.33< 1.33.7-r1
azurefile-csi-1.33< 1.33.6-r2
azurefile-csi-fips-1.29< 1.29.12-r9
azurefile-csi-fips-1.29-compat< 1.29.12-r9
azurefile-csi-fips-1.30< 1.30.10-r9
azurefile-csi-fips-1.30-compat< 1.30.10-r9
azurefile-csi-fips-1.31< 1.31.8-r5
azurefile-csi-fips-1.31-compat< 1.31.8-r5
azurefile-csi-fips-1.32< 1.32.8-r2
azurefile-csi-fips-1.32-compat< 1.32.8-r2
azurefile-csi-fips-1.33< 1.33.6-r2
bank-vaults-fips< 1.20.4-r35
bank-vaults-template-fips< 1.20.4-r35
beats-8.17< 8.17.10-r4
blob-csi-fips-1.23< 1.23.11-r60
blob-csi-fips-1.24< 1.24.11-r8
blob-csi-fips-1.24-compat< 1.24.11-r8
blob-csi-fips-1.26< 1.26.7-r6
blobfuse2-fips< 2.4.2-r8
blobfuse2-fips-health-monitor< 2.4.2-r8
blobfuse2-fips-syslog< 2.4.2-r8
boring-registry< 0.16.6-r4
boring-registry-fips< 0.16.6-r4
buildctl< 0.26.2-r1
buildctl-fips< 0.26.2-r2
buildkitd< 0.26.2-r1
buildkitd-fips< 0.26.2-r2
cass-operator-compat-fips< 1.28.0-r3
cass-operator-fips< 1.28.0-r3
cass-operator-fips-no-pvc-delete< 1.28.0-r1
cass-operator-fips-no-pvc-delete-compat< 1.28.0-r1
ceph-csi-operator-compat-fips< 0.4.1-r1
ceph-csi-operator-fips< 0.4.1-r1
cert-exporter-fips< 2.17.0-r2
cert-manager-acmesolver-fips-1.18< 1.18.3-r2
cert-manager-acmesolver-fips-1.19< 1.19.1-r2
cert-manager-cainjector-fips-1.18< 1.18.3-r2
cert-manager-cainjector-fips-1.19< 1.19.1-r2
cert-manager-controller-fips-1.18< 1.18.3-r2
cert-manager-controller-fips-1.19< 1.19.1-r2
cert-manager-csi-driver-fips< 0.11.1-r4
cert-manager-fips-1.17< 1.17.4-r5
cert-manager-fips-1.18< 1.18.3-r2 | < 1.18.4-r0
cert-manager-fips-1.19< 1.19.1-r2
cert-manager-google-cas-issuer-fips< 0.10.1-r2
cert-manager-istio-csr-compat-fips< 0.14.3-r2
cert-manager-istio-csr-fips< 0.14.3-r2
cert-manager-openshift-routes-fips< 0.8.3-r1
cert-manager-openshift-routes-fips-compat< 0.8.3-r1
cert-manager-startupapicheck-fips-1.18< 1.18.3-r2
cert-manager-startupapicheck-fips-1.19< 1.19.1-r2
cert-manager-webhook-fips-1.18< 1.18.3-r2 | < 1.18.4-r0
cert-manager-webhook-pdns< 2.5.3-r3
cert-manager-webhook-pdns-fips< 2.5.3-r4
certificate-transparency-fips< 1.3.2-r6
certificate-transparency-fips-trillian-ctserver< 1.3.2-r6
cfssl-bundle-fips< 1.6.5-r18
cfssl-certinfo-fips< 1.6.5-r18
cfssl-fips< 1.6.5-r18
cfssl-json-fips< 1.6.5-r18
cfssl-mkbundle-fips< 1.6.5-r18
cfssl-multirootca-fips< 1.6.5-r18
cfssl-newkey-fips< 1.6.5-r18
cfssl-scan-fips< 1.6.5-r18
chainctl< 0.2.183-r0
chart-testing-fips< 3.14.0-r2
chartmuseum-fips< 0.16.3-r10
chisel< 1.11.3-r3
chisel-compat< 1.11.3-r3
chisel-fips< 1.11.3-r3
cilium-certgen-0.2< 0.2.4-r5
cilium-envoy-fips-1.15< 1.15.19-r7
cilium-envoy-fips-1.16< 1.16.17-r1
cilium-envoy-fips-1.17< 1.17.10-r1
cilium-envoy-fips-1.18< 1.18.4-r1
cinder-csi-plugin-fips< 1.34.1-r2
cis-operator-1.4< 1.4.5-r1
cloud-provider-aws-fips-1.28< 1.28.11-r12
cloud-provider-aws-fips-1.28-cloud-controller-manager< 1.28.11-r12
cloud-provider-aws-fips-1.28-ecr-credential-provider< 1.28.11-r12
cloud-provider-aws-fips-1.29< 1.29.10-r2
cloud-provider-aws-fips-1.29-cloud-controller-manager< 1.29.10-r2
cloud-provider-aws-fips-1.29-ecr-credential-provider< 1.29.10-r2
cloud-provider-aws-fips-1.30< 1.30.10-r2
cloud-provider-aws-fips-1.30-cloud-controller-manager< 1.30.10-r2
cloud-provider-aws-fips-1.31< 1.31.9-r2
cloud-provider-aws-fips-1.31-cloud-controller-manager< 1.31.9-r2
cloud-provider-aws-fips-1.31-ecr-credential-provider< 1.31.9-r2
cloud-provider-aws-fips-1.32< 1.32.5-r2
cloud-provider-aws-fips-1.32-cloud-controller-manager< 1.32.5-r2
cloud-provider-aws-fips-1.32-ecr-credential-provider< 1.32.5-r2
cloud-provider-aws-fips-1.33< 1.33.2-r2
cloud-provider-aws-fips-1.33-cloud-controller-manager< 1.33.2-r2
cloud-provider-aws-fips-1.33-ecr-credential-provider< 1.33.2-r2

Show all 197

Alpine3 products

docker< 29.1.2-r0
go≥ 1.25.0, < 1.24.11-r0 | ≥ 1.25.0, < 1.25.5-r0
rclone< 1.72.1-r0

2 vendors · 200 products · Showing 200 of 2594

References

65 links

go.dev/cl/725920ARTICLEREPORTWEBFIXPatch
go.dev/issue/76445ARTICLEREPORTWEBIssue TrackingPatch
groups.google.com/g/golang-announce/c/8FJoBkPddm4ARTICLEREPORTWEBMailing ListRelease Notes
pkg.go.dev/vuln/GO-2025-4155AdvisoryREPORTWEBVendor Advisory
access.redhat.com/errata/RHSA-2026:0921Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2418462REPORT
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0921.jsonAdvisory
access.redhat.com/security/cve/CVE-2025-61729REPORT
www.cve.org/CVERecord?id=CVE-2025-61729AdvisoryREPORT

Show all 65 references