CVE-2025-61724 — Allocation of Resources Without Limits or Throttling in Standard Library NET Textproto

CWE-770 — Allocation of Resources Without Limits or Throttling CWE-1046 — Creation of Immutable Text Using String Concatenation9 documents8 sources

Severity

5.3MEDIUMNVD

EPSS

0.0%

top 94.35%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

GO Standard Library NET Textproto Golang GO

Timeline

PublishedOct 29

Latest updateOct 30

Description

The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶NVDgolang/go1.25.0 — 1.25.2+1

▶CVEListV5go_standard_library/net_textproto1.25.0 — 1.25.2+1

Patches

Patch: go.dev ↗

🔴Vulnerability Details

GHSA

GHSA-wcw9-47fp-rrfr: The Reader↗2025-10-30

▶

CVEList

Excessive CPU consumption in Reader.ReadResponse in net/textproto↗2025-10-29

▶

OSV

CVE-2025-61724: The Reader↗2025-10-29

▶

OSV

Excessive CPU consumption in Reader.ReadResponse in net/textproto↗2025-10-29

▶

📋Vendor Advisories

Red Hat

net/textproto: Excessive CPU consumption in Reader.ReadResponse in net/textproto↗2025-10-29

▶

Microsoft

Excessive CPU consumption in Reader.ReadResponse in net/textproto↗2025-10-14

▶

Debian

CVE-2025-61724: golang-1.15 - The Reader.ReadResponse function constructs a response string through repeated s...↗2025

▶

💬Community

Bugzilla

CVE-2025-61724 net/textproto: Excessive CPU consumption in Reader.ReadResponse in net/textproto↗2025-10-29

▶