Search results

net/textproto: excessive CPU consumption in Reader.ReadResponse (CVE-2025-61724) [1.25 backport]

CherryPickApprovedUsed during the release process for point releasesUsed during the release process for point releases

release-blocker

Security

Status: Closed (completed).

#75718 In golang/go;

· by gopherbot was closed on Oct 7, 2025

· 

Go1.25.2

crypto/x509: quadratic complexity when checking name constraints (CVE-2025-58187) [1.25 backport]

CherryPickApprovedUsed during the release process for point releasesUsed during the release process for point releases

release-blocker

Security

Status: Closed (completed).

#75715 In golang/go;

· by gopherbot was closed on Oct 7, 2025

· 

Go1.25.2

net/url: insufficient validation of bracketed IPv6 hostnames (CVE-2025-47912) [1.25 backport]

CherryPickApprovedUsed during the release process for point releasesUsed during the release process for point releases

release-blocker

Security

Status: Closed (completed).

#75713 In golang/go;

· by gopherbot was closed on Oct 7, 2025

· 

Go1.25.2

archive/tar: unbounded allocation when parsing GNU sparse map (CVE-2025-58183) [1.25 backport]

CherryPickApprovedUsed during the release process for point releasesUsed during the release process for point releases

release-blocker

Security

Status: Closed (completed).

#75711 In golang/go;

· by gopherbot was closed on Oct 7, 2025

· 

Go1.25.2

encoding/pem: quadratic complexity when parsing some invalid inputs (CVE-2025-61723) [1.25 backport]

CherryPickApprovedUsed during the release process for point releasesUsed during the release process for point releases

release-blocker

Security

Status: Closed (completed).

#75709 In golang/go;

· by gopherbot was closed on Oct 7, 2025

· 

Go1.25.2

net/http: lack of limit when parsing cookies can cause memory exhaustion (CVE-2025-58186) [1.25 backport]

CherryPickApprovedUsed during the release process for point releasesUsed during the release process for point releases

release-blocker

Security

Status: Closed (completed).

#75707 In golang/go;

· by gopherbot was closed on Oct 7, 2025

· 

Go1.25.2

encoding/asn1: pre-allocating memory when parsing DER payload can cause memory exhaustion (CVE-2025-58185) [1.25 backport]

CherryPickApprovedUsed during the release process for point releasesUsed during the release process for point releases

release-blocker

Security

Status: Closed (completed).

#75705 In golang/go;

· by gopherbot was closed on Oct 7, 2025

· 

Go1.25.2

crypto/x509: panic when validating certificates with DSA public keys (CVE-2025-58188) [1.25 backport]

CherryPickApprovedUsed during the release process for point releasesUsed during the release process for point releases

release-blocker

Security

Status: Closed (completed).

#75703 In golang/go;

· by gopherbot was closed on Oct 7, 2025

· 

Go1.25.2

net/mail: excessive CPU consumption in ParseAddress (CVE-2025-61725) [1.25 backport]

CherryPickApprovedUsed during the release process for point releasesUsed during the release process for point releases

release-blocker

Security

Status: Closed (completed).

#75701 In golang/go;

· by gopherbot was closed on Oct 7, 2025

· 

Go1.25.2

crypto/tls: ALPN negotiation error contains attacker controlled information [1.25 backport]

CherryPickApprovedUsed during the release process for point releasesUsed during the release process for point releases

Security

Status: Closed (completed).

#75661 In golang/go;

· by gopherbot was closed on Oct 1, 2025

· 

Go1.25.2