Resource exhaustion in Go programming language - CVE-2025-61725

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU118179

Resource exhaustion in Go programming language - CVE-2025-61725

Published: November 7, 2025


Vulnerability identifier: #VU118179
CSH Severity: Medium
CVSS v4 BT: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2025-61725
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the ParseAddress function in net/mail does not properly control consumption of internal resources. A remote attacker can compose a specially crafted email message that triggers excessive CPU consumption leading to denial of service. 


Affected software

Go programming language
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
BIG-IP Next for Kubernetes
SUSE Enterprise Storage
Fedora
Development Tools Module
openSUSE Leap
IBM Observability with Instana
IT Service Intelligence (ITSI)
App Connect Enterprise Certified Container
IBM Business Automation Workflow
IBM Cloud Pak for Business Automation
IBM MQ Operator
Guardium Data Security Center (GDSC)
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
IBM supplied MQ Advanced container images
Splunk Enterprise
hut
headscale
alertmanager
k9s
apptainer
containerd
skopeo
go1.24-doc
go1.24-race
go1.24
go1.24-openssl-doc
go1.24-openssl-race
go1.24-openssl
go1.24-openssl-debuginfo
go1.25-openssl-debuginfo
go1.25-openssl
go1.25-openssl-doc
go1.25-openssl-race
kubernetes1.31
cri-o1.32
kubernetes1.32
kubernetes1.33
cri-o1.33
kubernetes1.34
cri-o1.34
buildah
openbao
chezmoi
jfrog-cli
gh
prometheus
podman
gitleaks

How to mitigate CVE-2025-61725

Install updates from vendor's website.

Go programming language - addressed in versions 1.24.8, 1.25.2
IBM Observability with Instana - update to 1.0.311
BIG-IP Next for Kubernetes - update to 2.2.0
Guardium Data Security Center (GDSC) - update to 3.8.5
IT Service Intelligence (ITSI) - update to 4.21.2
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component - update to 5.2.2
Splunk Enterprise - addressed in versions 9.2.12, 9.3.9, 9.3.10, 9.4.8, 9.4.9, 10.0.3, 10.0.4, 10.2.1
App Connect Enterprise Certified Container - update to 12.19.0
IBM Business Automation Workflow - addressed in versions 24.0.0-IF008, 24.0.1-IF006, 25.0.0-IF003
IBM Cloud Pak for Business Automation - addressed in versions 24.0.0-IF008, 24.0.1-IF006, 25.0.0-IF004
hut - addressed in versions 0.8.0-1.fc43, 0.8.0-1.fc44
headscale - addressed in versions 0.28.0-1.fc43, 0.28.0-1.fc44
alertmanager - addressed in versions 0.31.1-1.el9, 0.31.1-2.fc42, 0.31.1-2.fc43
k9s - addressed in versions 0.50.16-2.fc42, 0.50.16-2.fc43
apptainer - addressed in versions 1.4.5-3.el8, 1.4.5-3.el9, 1.4.5-3.el10_1
containerd - addressed in versions 1.7.29-1.fc41, 2.0.7-1.fc42, 2.1.5-1.fc43
skopeo - addressed in versions 1.20.0-4.fc42, 1.20.0-5.fc43
go1.24-doc - update to 1.24.9-150000.1.42.1
go1.24-race - update to 1.24.9-150000.1.42.1
go1.24 - update to 1.24.9-150000.1.42.1
go1.24-openssl-doc - addressed in versions 1.24.12-150000.1.18.1, 1.24.12-150600.13.15.1
go1.24-openssl-race - addressed in versions 1.24.12-150000.1.18.1, 1.24.12-150600.13.15.1
go1.24-openssl - addressed in versions 1.24.12-150000.1.18.1, 1.24.12-150600.13.15.1
go1.24-openssl-debuginfo - update to 1.24.12-150600.13.15.1
go1.25-openssl-debuginfo - addressed in versions 1.25.6-150000.1.9.1, 1.25.6-150600.13.9.1
go1.25-openssl - addressed in versions 1.25.6-150000.1.9.1, 1.25.6-150600.13.9.1
go1.25-openssl-doc - addressed in versions 1.25.6-150000.1.9.1, 1.25.6-150600.13.9.1
go1.25-openssl-race - addressed in versions 1.25.6-150000.1.9.1, 1.25.6-150600.13.9.1
kubernetes1.31 - addressed in versions 1.31.14-1.fc41, 1.31.14-1.fc42, 1.31.14-1.fc43, 1.31.14-1.fc44
cri-o1.32 - addressed in versions 1.32.10-1.fc41, 1.32.10-1.fc42, 1.32.10-1.fc43, 1.32.10-1.fc44
kubernetes1.32 - addressed in versions 1.32.10-2.fc41, 1.32.10-2.fc42, 1.32.10-2.fc43, 1.32.10-2.fc44
kubernetes1.33 - addressed in versions 1.33.6-1.fc41, 1.33.6-1.fc42, 1.33.6-1.fc43, 1.33.6-1.fc44
cri-o1.33 - addressed in versions 1.33.6-1.fc43, 1.33.6-1.fc44
kubernetes1.34 - addressed in versions 1.34.2-1.fc41, 1.34.2-1.fc42, 1.34.2-1.fc43, 1.34.2-1.fc44
cri-o1.34 - addressed in versions 1.34.2-1.fc41, 1.34.2-1.fc42, 1.34.2-1.fc43, 1.34.2-1.fc44
buildah - addressed in versions 1.42.0-3.fc42, 1.42.0-4.fc43, 1.42.1-1.fc42
openbao - addressed in versions 2.4.3-2.fc41, 2.4.3-2.fc43, 2.5.0-1.el8, 2.5.1-1.el8
chezmoi - addressed in versions 2.69.4-1.el9, 2.69.4-1.el10_2, 2.69.4-1.el10_3, 2.69.4-1.fc42
jfrog-cli - update to 2.78.3-2.el9
gh - addressed in versions 2.83.0-1.el10_2, 2.83.0-1.fc43
IBM MQ Operator - update to 3.9.0
prometheus - addressed in versions 3.10.0-1.fc42, 3.10.0-1.fc43
podman - update to 5.7.0~rc2-1.fc42
gitleaks - update to 8.29.0-1.fc42
IBM supplied MQ Advanced container images - addressed in versions 9.4.0.17-r2, 9.4.5.0-r1

External References

Related Security Bulletins