Input validation error in Go programming language - CVE-2025-61728

Vulnerability identifier: #VU124033

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-61728

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when parsing zip archives. A remote attacker can pass specially crafted zip archive to the application and perform a denial of service (DoS) attack.

Go programming language
Guardium Data Security Center (GDSC)
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Business Automation Workflow
Splunk Operator for Kubernetes Add-on
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support
openEuler
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
toolbox-tests
toolbox
udica
python-pyasn1 (Red Hat package)
butane (Red Hat package)
slirp4netns
runc (Red Hat package)
runc
oci-seccomp-bpf-hook
containernetworking-plugins (Red Hat package)
containernetworking-plugins
aardvark-dns
netavark
skopeo (Red Hat package)
fuse-overlayfs
crun
skopeo
skopeo-tests
golang-help
golang
golang-devel
golang (Red Hat package)
golang-tests
golang-src
golang-misc
golang-docs
golang-shared
golang-bin
delve
golang-race
go-toolset
cri-tools (Red Hat package)
cri-o (Red Hat package)
buildah
buildah-tests
containers-common
conmon
conmon (Red Hat package)
container-selinux
python3-criu
criu-libs
criu-devel
criu
crit
libslirp
libslirp-devel
podman (Red Hat package)
python3-podman
podman-remote
podman-docker
podman-plugins
podman
podman-catatonit
podman-gvproxy
podman-tests
ose-aws-ecr-image-credential-provider (Red Hat package)
openshift (Red Hat package)
ose-azure-acr-image-credential-provider (Red Hat package)
ose-gcp-gcr-image-credential-provider (Red Hat package)
openshift-clients (Red Hat package)
kernel (Red Hat package)
grafana (Red Hat package)
grafana
grafana-selinux
cockpit-podman
osbuild-composer-worker
osbuild-composer-core
osbuild-composer
osbuild-composer (Red Hat package)
Red Hat OpenShift Container Platform
OpenShift Data Foundation (formerly OpenShift Container Storage)

Install updates from vendor's website.

Go programming language - addressed in versions 1.24.12, 1.25.6
Guardium Data Security Center (GDSC) - update to 3.8.8
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.3.1 Patch 2
IBM Business Automation Workflow - addressed in versions 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0
toolbox-tests - update to 0.0.99.5.1-1.0.1
toolbox - update to 0.0.99.5.1-1.0.1
udica - update to 0.2.6-21
python-pyasn1 (Red Hat package) - update to 0.5.1-4.el9
butane (Red Hat package) - update to 0.25.1-3.rhaos4.20.el8
slirp4netns - update to 1.2.3-1
runc (Red Hat package) - update to 1.2.9-3.rhaos4.20.el9
runc - update to 1.2.9-4
oci-seccomp-bpf-hook - update to 1.2.10-1
containernetworking-plugins (Red Hat package) - addressed in versions 1.4.0-6.rhaos4.14.el8, 1.4.0-7.rhaos4.13.el8
containernetworking-plugins - update to 1.4.0-8.0.1
aardvark-dns - update to 1.10.1-2.0.1
netavark - update to 1.10.3-1.0.1
skopeo (Red Hat package) - addressed in versions 1.11.3-6.rhaos4.13.el8, 1.11.3-6.rhaos4.13.el9, 1.11.3-7.rhaos4.14.el8, 1.11.3-7.rhaos4.14.el9
fuse-overlayfs - update to 1.13-1.0.1
crun - update to 1.14.3-2
skopeo - update to 1.14.5-7
skopeo-tests - update to 1.14.5-7
golang-help - addressed in versions 1.17.3-47, 1.21.4-42, 1.21.4-43, 1.21.4-45
golang - addressed in versions 1.17.3-47, 1.21.4-42, 1.21.4-43, 1.21.4-45
golang-devel - addressed in versions 1.17.3-47, 1.21.4-42, 1.21.4-43, 1.21.4-45
golang (Red Hat package) - addressed in versions 1.17.13-10.el9_0, 1.19.13-23.el9_2, 1.21.13-14.el9_4, 1.25.7-1.el9_6, 1.25.7-1.el9_7, 1.25.7-1.el10_0, 1.25.7-1.el10_1
golang-tests - addressed in versions 1.24.11-2, 1.25.7-1.0.1
golang-src - addressed in versions 1.24.11-2, 1.25.7-1.0.1
golang-misc - addressed in versions 1.24.11-2, 1.25.7-1.0.1
golang-docs - addressed in versions 1.24.11-2, 1.25.7-1.0.1
golang-shared - update to 1.24.11-2
golang-bin - addressed in versions 1.24.11-2, 1.25.7-1.0.1
golang - addressed in versions 1.24.11-2, 1.25.7-1.0.1
delve - update to 1.25.2-1.0.2
golang-race - update to 1.25.7-1.0.1
go-toolset - update to 1.25.7-1.0.1
cri-tools (Red Hat package) - update to 1.33.0-3.el9
cri-o (Red Hat package) - update to 1.33.9-3.rhaos4.20.gitb9ac835.el9
buildah - update to 1.33.14-3
buildah-tests - update to 1.33.14-3
containers-common - update to 1-82.0.1
conmon - update to 2.1.10-1
conmon (Red Hat package) - update to 2.1.12-12.rhaos4.20.el9
container-selinux - update to 2.229.0-2
Splunk Operator for Kubernetes Add-on - update to 3.1.0
python3-criu - update to 3.18-5.0.1
criu-libs - update to 3.18-5.0.1
criu-devel - update to 3.18-5.0.1
criu - update to 3.18-5.0.1
crit - update to 3.18-5.0.1
libslirp - update to 4.4.0-2
libslirp-devel - update to 4.4.0-2
podman (Red Hat package) - addressed in versions 4.4.1-19.rhaos4.13.el8, 4.4.1-20.rhaos4.13.el9, 4.4.1-22.el9_2.11, 4.4.1-25.rhaos4.14.el8, 4.4.1-25.rhaos4.14.el9, 4.9.4-20.el9_4.2, 5.2.2-11.rhaos4.18.el8, 5.4.0-15.el10_0.1, 5.4.0-16.rhaos4.20.el9, 5.4.0-20.el9_6.2, 5.6.0-12.el10_1, 5.6.0-14.el9_7
python3-podman - update to 4.9.0-3
podman-remote - update to 4.9.4-30.0.1
podman-docker - update to 4.9.4-30.0.1
podman-plugins - update to 4.9.4-30.0.1
podman - update to 4.9.4-30.0.1
podman-catatonit - update to 4.9.4-30.0.1
podman-gvproxy - update to 4.9.4-30.0.1
podman-tests - update to 4.9.4-30.0.1
Red Hat OpenShift Container Platform - addressed in versions 4.13.68, 4.14.68, 4.18.42, 4.20.16
ose-aws-ecr-image-credential-provider (Red Hat package) - addressed in versions 4.14.0-202606041348.p2.g9a7820e.assembly.stream.el8, 4.14.0-202606041348.p2.g9a7820e.assembly.stream.el9, 4.20.0-202602241728.p2.gbb88da1.assembly.stream.el8, 4.20.0-202602241728.p2.gbb88da1.assembly.stream.el9
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.19.19
openshift (Red Hat package) - addressed in versions 4.20.0-202602241728.p2.gb96a403.assembly.stream.el8, 4.20.0-202602241728.p2.gb96a403.assembly.stream.el9
ose-azure-acr-image-credential-provider (Red Hat package) - addressed in versions 4.20.0-202602241728.p2.gd469d04.assembly.stream.el8, 4.20.0-202602241728.p2.gd469d04.assembly.stream.el9
ose-gcp-gcr-image-credential-provider (Red Hat package) - addressed in versions 4.20.0-202602261434.p2.ge3014e7.assembly.stream.el8, 4.20.0-202602261434.p2.ge3014e7.assembly.stream.el9
openshift-clients (Red Hat package) - addressed in versions 4.20.0-202603030647.p2.g64e778a.assembly.stream.el8, 4.20.0-202603030647.p2.g64e778a.assembly.stream.el9
kernel (Red Hat package) - update to 5.14.0-570.96.1.el9_6
grafana (Red Hat package) - addressed in versions 7.5.11-9.el8_6, 7.5.11-13.el9_0, 7.5.15-9.el8_8, 9.0.9-10.el9_2, 9.2.10-25.el9_4, 9.2.10-28.el8_10, 10.2.6-18.el9_6, 10.2.6-18.el9_7, 10.2.6-21.el10_0, 10.2.6-22.el10_1
grafana - update to 9.2.10-28.0.1
grafana-selinux - update to 9.2.10-28.0.1
cockpit-podman - update to 84.1-1
osbuild-composer-worker - update to 149-4
osbuild-composer-core - update to 149-4
osbuild-composer - update to 149-4
osbuild-composer (Red Hat package) - addressed in versions 149-4.el9_7, 149-5.el10_1

• https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc
• https://github.com/golang/go/issues/77102

• Red Hat Enterprise Linux 10 update for golang
• Red Hat Enterprise Linux 8 update for the go-toolset:rhel8 module
• Red Hat Enterprise Linux 9 update for golang
• Red Hat Enterprise Linux 10 update for grafana
• Red Hat Enterprise Linux 9 update for grafana
• Red Hat Enterprise Linux 8 update for grafana
• Red Hat Enterprise Linux 10 update for golang
• Red Hat Enterprise Linux 9 update for golang
• Red Hat Enterprise Linux 10 update for podman
• Red Hat Enterprise Linux 9 update for podman
• Red Hat Enterprise Linux 9 update for golang
• Red Hat Enterprise Linux 8 update for the go-toolset:rhel8 module
• Red Hat Enterprise Linux 9 update for golang
• Red Hat Enterprise Linux 9 update for golang
• Red Hat Enterprise Linux 8 update for the go-toolset:rhel8 module
• Red Hat Enterprise Linux 10 update for osbuild-composer
• Red Hat Enterprise Linux 9 update for osbuild-composer
• Red Hat Enterprise Linux 10 update for grafana
• Red Hat Enterprise Linux 9 update for grafana
• Red Hat Enterprise Linux 9 update for grafana
• Red Hat Enterprise Linux 9 update for grafana
• Red Hat Enterprise Linux 8 update for grafana
• Multiple vulnerabilities in Go programming language
• Red Hat Enterprise Linux 9 update for grafana
• Red Hat Enterprise Linux 8 update for grafana
• Input validation error in Red Hat OpenShift Container Platform 4.20 packages
• Anolis OS update for grafana
• Anolis OS update for go-toolset:an8 module
• Anolis OS update for golang
• Red Hat Enterprise Linux 8 update for the container-tools:rhel8 module
• Anolis OS update for container-tools:an8 module
• openEuler 24.03 LTS SP1 update for golang
• openEuler 24.03 LTS update for golang
• openEuler 22.03 LTS SP4 update for golang
• openEuler 24.03 LTS SP3 update for golang
• openEuler 24.03 LTS SP2 update for golang
• Anolis OS update for osbuild-composer
• Multiple vulnerabilities in IBM Guardium Data Security Center
• Red Hat Enterprise Linux 9 update for podman
• IBM Watson Speech Services Cartridge update for archive/zip
• Splunk Operator for Kubernetes Add-on update for third-party components
• Red Hat Enterprise Linux 9 update for podman
• Red Hat Enterprise Linux 10 update for podman
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.18 packages
• Red Hat Enterprise Linux 9 update for podman
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.19
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13 packages
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14 packages
• Multiple vulnerabilities in IBM Business Automation Workflow