BIT-golang-2025-61729Published
Excessive resource consumption when printing error string for host certificate validation in crypto/x509
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2025-61729 · Microsoft / collected KEV context
cve-program · CVE-2025-61729
- https://go.dev/cl/725920
- https://go.dev/issue/76445
- https://groups.google.com/g/golang-announce/c/8FJoBkPddm4
- https://pkg.go.dev/vuln/GO-2025-4155
euvd · EUVD-2025-200318
- https://go.dev/cl/725920
- https://go.dev/issue/76445
- https://groups.google.com/g/golang-announce/c/8FJoBkPddm4
- https://pkg.go.dev/vuln/GO-2025-4155
nvd · CVE-2025-61729
- https://go.dev/cl/725920
- https://go.dev/issue/76445
- https://groups.google.com/g/golang-announce/c/8FJoBkPddm4
- https://pkg.go.dev/vuln/GO-2025-4155
osv · GO-2025-4155
Related operational evidence
Explicit CVE identifiers- Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime.… · Advisory content revised · 9 Nov 2026
- Release 2026-02-08 · Tool release · 17 Feb 2026