CVE-2025-61728 Excessive CPU consumption when building archive index in archive/zip
Attackers can cause denial of service by providing malicious ZIP archives that trigger excessive CPU consumption during index building.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-61728?
CVE-2025-61728 is a medium-severity denial of service vulnerability in Golang Go, published on 28 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.
Weakness: CWE-770
Which versions are affected by CVE-2025-61728?
2 open source packages ship an affected version, including golang and stdlib. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
golang Bitnami | All versions | 1.24.12, 1.25.6 |
stdlib Go | All versions | 1.24.12, 1.25.6 |
Linux distribution packages (21)
flightctl Red Hat:edge_manager:1.1::el10 | All versions | 0:1.1.2-1.el10em |
flightctl-agent Red Hat:edge_manager:1.1::el10 | All versions | 0:1.1.2-1.el10em |
flightctl-cli Red Hat:edge_manager:1.1::el10 | All versions | 0:1.1.2-1.el10em |
flightctl-observability Red Hat:edge_manager:1.1::el10 | All versions | 0:1.1.2-1.el10em |
flightctl-selinux Red Hat:edge_manager:1.1::el10 | All versions | 0:1.1.2-1.el10em |
flightctl-services Red Hat:edge_manager:1.1::el10 | All versions | 0:1.1.2-1.el10em |
flightctl Red Hat:edge_manager:1.1::el9 | All versions | 0:1.1.2-1.el9em |
flightctl-agent Red Hat:edge_manager:1.1::el9 | All versions | 0:1.1.2-1.el9em |
flightctl-cli Red Hat:edge_manager:1.1::el9 | All versions | 0:1.1.2-1.el9em |
flightctl-observability Red Hat:edge_manager:1.1::el9 | All versions | 0:1.1.2-1.el9em |
flightctl-selinux Red Hat:edge_manager:1.1::el9 | All versions | 0:1.1.2-1.el9em |
flightctl-services Red Hat:edge_manager:1.1::el9 | All versions | 0:1.1.2-1.el9em |
podman Red Hat:openshift:4.20::el9 | All versions | 5:5.4.0-16.rhaos4.20.el9 |
podman-debuginfo Red Hat:openshift:4.20::el9 | All versions | 5:5.4.0-16.rhaos4.20.el9 |
podman-debugsource Red Hat:openshift:4.20::el9 | All versions | 5:5.4.0-16.rhaos4.20.el9 |
podman-docker Red Hat:openshift:4.20::el9 | All versions | 5:5.4.0-16.rhaos4.20.el9 |
podman-plugins Red Hat:openshift:4.20::el9 | All versions | 5:5.4.0-16.rhaos4.20.el9 |
podman-plugins-debuginfo Red Hat:openshift:4.20::el9 | All versions | 5:5.4.0-16.rhaos4.20.el9 |
podman-remote Red Hat:openshift:4.20::el9 | All versions | 5:5.4.0-16.rhaos4.20.el9 |
podman-remote-debuginfo Red Hat:openshift:4.20::el9 | All versions | 5:5.4.0-16.rhaos4.20.el9 |
podman-tests Red Hat:openshift:4.20::el9 | All versions | 5:5.4.0-16.rhaos4.20.el9 |
Products include Golang Go.
How do I fix CVE-2025-61728?
Upgrade golang to a fixed version for your release line: 1.24.12 or 1.25.6.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-61728 being exploited?
There is no known exploitation of CVE-2025-61728 in the wild and no public exploit code.
Other vulnerabilities in Golang Go
- CVE-2020-0601 Microsoft Windows CryptoAPI Spoofing
- CVE-2026-27143 Missing bound checks can lead to memory corruption in safe Go in cmd/compile
- CVE-2024-24790 Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip
- CVE-2023-39320 Arbitrary code execution via go.mod toolchain directive in cmd/go
- CVE-2023-24540 Improper handling of JavaScript whitespace in html/template
Sources
Also known as AZL-75707, AZL-75719, AZL-78929, AZL-98715, BELL-CVE-2025-61728, BIT-golang-2025-61728 and 436 more.