Resource exhaustion in Go programming language - CVE-2025-61729

 

Resource exhaustion in Go programming language - CVE-2025-61729

Published: December 6, 2025 / Updated: February 17, 2026


Vulnerability identifier: #VU119235
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-61729
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within the HostnameError.Error() function in crypto/x509 when printing error string for host certificate validation. A remote attacker can supply a specially crafted certificate to the application and trigger resource exhaustion, leading to a denial of service condition. 


Affected software

Go programming language
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Enterprise Storage
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Anolis OS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Development Tools Module
openSUSE Leap
openEuler
Netezza Appliance
Guardium Data Security Center (GDSC)
watsonx.data integration
Dell EMC OpenManage Enterprise Modular
Red Hat OpenShift GitOps
cert-manager Operator for Red Hat OpenShift
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
App Connect Enterprise Certified Container
IBM Business Automation Workflow
Oracle Blockchain Platform
iDRAC10
Ansible Automation Platform
Red Hat OpenStack
Planning Analytics Local
watsonx.data
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
toolbox-tests
toolbox
rhc (Red Hat package)
rhc-worker-playbook (Red Hat package)
udica
yggdrasil (Red Hat package)
python3.11-galaxy-importer (Red Hat package)
python-pyasn1 (Red Hat package)
gvisor-tap-vsock (Red Hat package)
golang-github-openprinting-ipp-usb (Red Hat package)
butane (Red Hat package)
opentelemetry-collector (Red Hat package)
containernetworking-plugins (Red Hat package)
slirp4netns
automation-eda-controller (Red Hat package)
runc (Red Hat package)
runc
oci-seccomp-bpf-hook
containernetworking-plugins
containernetworking-plugins-doc
receptor (Red Hat package)
aardvark-dns
netavark
skopeo (Red Hat package)
fuse-overlayfs
crun
skopeo-tests
skopeo
golang
golang-help
golang-devel
golang (Red Hat package)
go-toolset
golang-tests
golang-src
golang-misc
golang-docs
golang-shared
golang-bin
go1.24-doc
go1.24-race
go1.24
go1.24-openssl-doc
go1.24-openssl
go1.24-openssl-race
go1.24-openssl-debuginfo
delve
delve (Red Hat package)
golang-race
go1.25
go1.25-race
go1.25-doc
go1.25-openssl-race
go1.25-openssl-doc
go1.25-openssl
go1.25-openssl-debuginfo
buildah (Red Hat package)
buildah-tests
buildah
python3.11-botocore (Red Hat package)
containers-common
conmon
automation-gateway (Red Hat package)
python3.11-urllib3 (Red Hat package)
ansible-automation-platform-installer (Red Hat package)
automation-platform-ui (Red Hat package)
python3.11-django-ansible-base (Red Hat package)
git-lfs (Red Hat package)
ansible-core (Red Hat package)
python3.11-requests (Red Hat package)
container-selinux
grafana-pcp (Red Hat package)
git-lfs-doc
git-lfs
etcd (Red Hat package)
criu
criu-devel
criu-libs
crit
python3-criu
python3.11-pulpcore (Red Hat package)
python3.11-django (Red Hat package)
python-django (Red Hat package)
libslirp-devel
libslirp
podman (Red Hat package)
automation-controller (Red Hat package)
python3-podman
podman-catatonit
podman-gvproxy
podman-plugins
podman-remote
podman-tests
podman-docker
podman
automation-hub (Red Hat package)
python3.11-galaxy-ng (Red Hat package)
ose-aws-ecr-image-credential-provider (Red Hat package)
ose-azure-acr-image-credential-provider (Red Hat package)
ose-gcp-gcr-image-credential-provider (Red Hat package)
python3.11-protobuf (Red Hat package)
grafana-pcp
kernel (Red Hat package)
grafana (Red Hat package)
grafana-selinux
grafana
ansible-dev-tools (Red Hat package)
ansible-lint (Red Hat package)
ansible-navigator (Red Hat package)
osbuild-composer (Red Hat package)
image-builder (Red Hat package)
cockpit-podman
osbuild-composer
osbuild-composer-core
osbuild-composer-worker
Red Hat OpenShift Container Platform
OpenShift Data Foundation (formerly OpenShift Container Storage)

How to mitigate CVE-2025-61729

Install updates from vendor's website.

Go programming language - addressed in versions 1.24.11, 1.25.5
Netezza Appliance - update to 1.0.0.1
Red Hat OpenShift GitOps - addressed in versions 1.17.4, 1.18.3
cert-manager Operator for Red Hat OpenShift - update to 1.18.1
Planning Analytics Local - update to 2.1.18
watsonx.data - update to 2.3.1
Guardium Data Security Center (GDSC) - update to 3.8.8
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.3.1 Patch 2
watsonx.data integration - update to 5.3.1
App Connect Enterprise Certified Container - addressed in versions 12.0.20, 12.20.0
IBM Business Automation Workflow - addressed in versions 24.0.0-IF008, 24.0.1-IF006, 25.0.0-IF003
toolbox-tests - update to 0.0.99.5.1-1.0.1
toolbox - update to 0.0.99.5.1-1.0.1
rhc (Red Hat package) - addressed in versions 0.2.0-5.el8_4, 0.2.1-12.el9_0, 0.2.1-13.el8_6, 0.2.2-1.el8_8.1, 0.2.4-3.el7_9, 0.2.5-4.el8_10, 0.3.2-2.el10_0, 0.3.4-2.el10_1
rhc-worker-playbook (Red Hat package) - addressed in versions 0.2.3-3.el10_0, 0.2.3-3.el10_1
udica - update to 0.2.6-21
yggdrasil (Red Hat package) - addressed in versions 0.4.7-2.el10_0, 0.4.8-3.el10_1
python3.11-galaxy-importer (Red Hat package) - addressed in versions 0.4.37-2.el8ap, 0.4.37-2.el9ap
python-pyasn1 (Red Hat package) - update to 0.5.1-4.el9
gvisor-tap-vsock (Red Hat package) - addressed in versions 0.7.3-5.el9_4.3, 0.8.5-2.el9_6.1, 0.8.5-2.el10_0.1
golang-github-openprinting-ipp-usb (Red Hat package) - addressed in versions 0.9.27-3.el10_0.1, 0.9.27-4.el10_1
butane (Red Hat package) - update to 0.20.0-1.el9_4.1
opentelemetry-collector (Red Hat package) - addressed in versions 0.135.0-3.el9_4, 0.135.0-3.el9_6, 0.135.0-3.el10_0
containernetworking-plugins (Red Hat package) - addressed in versions 1.2.0-3.el9_2.3, 1.4.0-6.rhaos4.14.el8, 1.4.0-6.rhaos4.15.el8, 1.4.0-7.rhaos4.13.el8, 1.4.0-7.rhaos4.16.el8, 1.6.2-3.el9_6
slirp4netns - update to 1.2.3-1
automation-eda-controller (Red Hat package) - update to 1.2.4-1.el9ap
runc (Red Hat package) - addressed in versions 1.2.9-1.el9_2.2, 1.2.9-1.el9_4.1, 1.2.9-2.rhaos4.16.el8, 1.2.9-2.rhaos4.16.el9, 1.2.9-3.el9_6, 1.4.0-2.el9_7
runc - update to 1.2.9-3
oci-seccomp-bpf-hook - update to 1.2.10-1
containernetworking-plugins - addressed in versions 1.3.0-2, 1.4.0-7.0.1
containernetworking-plugins-doc - update to 1.3.0-2
receptor (Red Hat package) - addressed in versions 1.6.3-1.el8ap, 1.6.3-1.el9ap, 1.6.3-2.el9ap, 1.6.3-2.el10ap
aardvark-dns - update to 1.10.1-2.0.1
netavark - update to 1.10.3-1.0.1
skopeo (Red Hat package) - addressed in versions 1.11.3-6.rhaos4.13.el8, 1.11.3-6.rhaos4.13.el9, 1.11.3-7.rhaos4.14.el8, 1.11.3-7.rhaos4.14.el9, 1.11.3-8.rhaos4.15.el8, 1.11.3-9.rhaos4.15.el9, 1.11.4-0.1.el9_2.6, 1.14.5-2.el9_4.4, 1.14.5-5.rhaos4.16.el8, 1.14.5-5.rhaos4.16.el9, 1.18.1-3.el10_0.1, 1.18.1-5.el9_6, 1.20.0-3.el10_1
fuse-overlayfs - update to 1.13-1.0.1
crun - update to 1.14.3-2
skopeo-tests - update to 1.14.5-6
skopeo - update to 1.14.5-6
golang - addressed in versions 1.15.7-58, 1.17.3-46, 1.21.4-41, 1.21.4-42
golang-help - addressed in versions 1.15.7-58, 1.17.3-46, 1.21.4-41, 1.21.4-42
golang-devel - addressed in versions 1.15.7-58, 1.17.3-46, 1.21.4-41, 1.21.4-42
golang (Red Hat package) - addressed in versions 1.17.13-9.el9_0, 1.19.13-21.el9_2, 1.21.13-13.el9_4, 1.25.5-1.el10_0, 1.25.5-1.el10_1, 1.25.5-2.el9_7
go-toolset - addressed in versions 1.24.6-1, 1.25.5-1.0.1
golang-tests - addressed in versions 1.24.11-1, 1.25.5-1.0.1
golang-src - addressed in versions 1.24.11-1, 1.25.5-1.0.1
golang-misc - addressed in versions 1.24.11-1, 1.25.5-1.0.1
golang-docs - addressed in versions 1.24.11-1, 1.25.5-1.0.1
golang-shared - update to 1.24.11-1
golang-bin - addressed in versions 1.24.11-1, 1.25.5-1.0.1
golang - addressed in versions 1.24.11-1, 1.25.5-1.0.1
go1.24-doc - update to 1.24.11-150000.1.50.1
go1.24-race - update to 1.24.11-150000.1.50.1
go1.24 - update to 1.24.11-150000.1.50.1
go1.24-openssl-doc - addressed in versions 1.24.12-150000.1.18.1, 1.24.12-150600.13.15.1
go1.24-openssl - addressed in versions 1.24.12-150000.1.18.1, 1.24.12-150600.13.15.1
go1.24-openssl-race - addressed in versions 1.24.12-150000.1.18.1, 1.24.12-150600.13.15.1
go1.24-openssl-debuginfo - update to 1.24.12-150600.13.15.1
delve - update to 1.25.2-1.0.2
delve (Red Hat package) - addressed in versions 1.25.2-2.el10_0, 1.25.2-2.el10_1
golang-race - update to 1.25.5-1.0.1
go1.25 - update to 1.25.5-150000.1.23.1
go1.25-race - update to 1.25.5-150000.1.23.1
go1.25-doc - update to 1.25.5-150000.1.23.1
go1.25-openssl-race - addressed in versions 1.25.6-150000.1.9.1, 1.25.6-150600.13.9.1
go1.25-openssl-doc - addressed in versions 1.25.6-150000.1.9.1, 1.25.6-150600.13.9.1
go1.25-openssl - addressed in versions 1.25.6-150000.1.9.1, 1.25.6-150600.13.9.1
go1.25-openssl-debuginfo - addressed in versions 1.25.6-150000.1.9.1, 1.25.6-150600.13.9.1
buildah (Red Hat package) - addressed in versions 1.26.11-1.el9_0, 1.29.7-1.el9_2.5, 1.39.6-2.el9_6, 1.39.8-1.el10_0, 1.41.8-2.el9_7, 1.41.8-2.el10_1
iDRAC10 - addressed in versions 1.30.10.50, 1.30.10.51
buildah-tests - update to 1.33.14-2
buildah - update to 1.33.14-2
python3.11-botocore (Red Hat package) - addressed in versions 1.34.162-1.el8ap, 1.34.162-1.el9ap
containers-common - update to 1-82.0.1
conmon - update to 2.1.10-1
Ansible Automation Platform - addressed in versions 2.4, 2.5, 2.6
automation-gateway (Red Hat package) - addressed in versions 2.5.20260121-1.el8ap, 2.5.20260121-1.el9ap, 2.6.20260121-1.el9ap
python3.11-urllib3 (Red Hat package) - addressed in versions 2.6.3-1.el8ap, 2.6.3-1.el9ap
ansible-automation-platform-installer (Red Hat package) - update to 2.6-4.el9ap
automation-platform-ui (Red Hat package) - update to 2.6.5-1.el9ap
python3.11-django-ansible-base (Red Hat package) - update to 2.6.20260121-1.el9ap
git-lfs (Red Hat package) - addressed in versions 2.13.3-3.el8_4.4, 2.13.3-5.el9_0.6, 3.2.0-2.el8_8.6, 3.2.0-2.el9_2.5, 3.4.1-4.el9_4.4, 3.4.1-7.el8_10, 3.6.1-2.el9_6.2, 3.6.1-2.el10_0.2, 3.6.1-7.el9_7, 3.6.1-7.el10_1
ansible-core (Red Hat package) - addressed in versions 2.16.15-1.el8ap, 2.16.15-1.el9ap, 2.16.15-2.el10ap
Dell EMC OpenManage Enterprise Modular - update to 2.20.20
python3.11-requests (Red Hat package) - addressed in versions 2.31.0-3.el8ap, 2.31.0-3.el9ap
container-selinux - update to 2.229.0-2
grafana-pcp (Red Hat package) - addressed in versions 3.0.2-3.el8_4, 3.2.0-3.el8_6, 3.2.0-5.el8_8, 3.2.0-5.el9_0, 5.1.1-4.el9_2, 5.1.1-6.el9_4, 5.1.1-11.el8_10, 5.2.2-4.el10_0, 5.3.0-2.el10_1
git-lfs-doc - update to 3.4.1-7.0.1
git-lfs - update to 3.4.1-7.0.1
etcd (Red Hat package) - update to 3.4.26-9.5.el9ost
criu - update to 3.18-5.0.1
criu-devel - update to 3.18-5.0.1
criu-libs - update to 3.18-5.0.1
crit - update to 3.18-5.0.1
python3-criu - update to 3.18-5.0.1
python3.11-pulpcore (Red Hat package) - update to 3.49.49-1.el9ap
python3.11-django (Red Hat package) - addressed in versions 4.2.27-1.el8ap, 4.2.27-1.el9ap, 4.2.27-2.el9ap
python-django (Red Hat package) - update to 4.2.27-2.el10ap
libslirp-devel - update to 4.4.0-2
libslirp - update to 4.4.0-2
podman (Red Hat package) - addressed in versions 4.4.1-19.rhaos4.13.el8, 4.4.1-20.rhaos4.13.el9, 4.4.1-22.el9_2.11, 4.4.1-25.rhaos4.14.el8, 4.4.1-25.rhaos4.14.el9, 4.4.1-39.rhaos4.15.el8, 4.9.4-20.el9_4.2, 5.2.2-11.rhaos4.18.el8, 5.4.0-15.el10_0.1, 5.4.0-20.el9_6.2, 5.6.0-12.el10_1, 5.6.0-14.el9_7
automation-controller (Red Hat package) - addressed in versions 4.5.30-1.el8ap, 4.5.30-1.el9ap, 4.6.25-1.el8ap, 4.6.25-1.el9ap, 4.7.8-1.el9ap
python3-podman - update to 4.9.0-3
podman-catatonit - update to 4.9.4-28.0.1
podman-gvproxy - update to 4.9.4-28.0.1
podman-plugins - update to 4.9.4-28.0.1
podman-remote - update to 4.9.4-28.0.1
podman-tests - update to 4.9.4-28.0.1
podman-docker - update to 4.9.4-28.0.1
podman - update to 4.9.4-28.0.1
automation-hub (Red Hat package) - addressed in versions 4.10.11-1.el8ap, 4.10.11-1.el9ap, 4.11.5-1.el9ap
python3.11-galaxy-ng (Red Hat package) - addressed in versions 4.10.11-2.el8ap, 4.10.11-2.el9ap, 4.11.5-1.el9ap
Red Hat OpenShift Container Platform - addressed in versions 4.13.68, 4.14.68, 4.15.66, 4.16.58, 4.18.42
ose-aws-ecr-image-credential-provider (Red Hat package) - addressed in versions 4.14.0-202606041348.p2.g9a7820e.assembly.stream.el8, 4.14.0-202606041348.p2.g9a7820e.assembly.stream.el9, 4.15.0-202606040938.p2.gfd77d92.assembly.stream.el8, 4.15.0-202606040938.p2.gfd77d92.assembly.stream.el9
ose-azure-acr-image-credential-provider (Red Hat package) - addressed in versions 4.15.0-202606040938.p2.g0d799a2.assembly.stream.el8, 4.15.0-202606040938.p2.g0d799a2.assembly.stream.el9
ose-gcp-gcr-image-credential-provider (Red Hat package) - addressed in versions 4.15.0-202606040938.p2.gfc50272.assembly.stream.el8, 4.15.0-202606040938.p2.gfc50272.assembly.stream.el9
OpenShift Data Foundation (formerly OpenShift Container Storage) - addressed in versions 4.18.24, 4.18.25
python3.11-protobuf (Red Hat package) - update to 4.25.8-1.el9ap
grafana-pcp - update to 5.1.1-11
kernel (Red Hat package) - update to 5.14.0-427.115.1.el9_4
grafana (Red Hat package) - addressed in versions 6.3.6-10.el8_2, 7.3.6-12.el8_4, 7.5.11-9.el8_6, 7.5.11-13.el9_0, 7.5.15-9.el8_8, 9.0.9-10.el9_2, 9.2.10-25.el9_4, 9.2.10-27.el8_10, 10.2.6-18.el9_6, 10.2.6-18.el9_7, 10.2.6-21.el10_0, 10.2.6-22.el10_1
grafana-selinux - update to 9.2.10-27.0.1
grafana - update to 9.2.10-27.0.1
Red Hat OpenStack - update to 17.1
ansible-dev-tools (Red Hat package) - addressed in versions 26.1.0-1.el8ap, 26.1.0-1.el9ap, 26.1.0-2.el9ap, 26.1.0-2.el10ap
ansible-lint (Red Hat package) - addressed in versions 26.1.0-1.el8ap, 26.1.0-1.el9ap, 26.1.0-2.el9ap, 26.1.0-2.el10ap
ansible-navigator (Red Hat package) - addressed in versions 26.1.1-1.el8ap, 26.1.1-1.el9ap, 26.1.1-2.el9ap, 26.1.1-2.el10ap
osbuild-composer (Red Hat package) - addressed in versions 28.7-5.el8_4, 46.3-6.el8_6, 46.3-7.el9_0, 75-7.el8_8, 76.1-5.el9_2, 101.3-4.el9_4, 101.4-3.el8_10, 132.2-5.el9_6, 134.1-5.el10_0, 149-4.el9_7, 149-5.el10_1
image-builder (Red Hat package) - addressed in versions 31-3.el9_7, 31-4.el10_1
cockpit-podman - update to 84.1-1
osbuild-composer - update to 149-4
osbuild-composer-core - update to 149-4
osbuild-composer-worker - update to 149-4

External References

Related Security Bulletins