Vulnerability · Published Jan 28, 2026 · Assigned by Go

CVE-2025-61728Excessive CPU consumption when building archive index in archive/zip

Medium 6.5

In plain English

A medium-severity security flaw in archive/zip from Go standard library. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.7%top 45.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8aardvark-dns2:1.10.1-2.module_el8.10.0+4089+ce72bbbeALSA-2026:4672
AlmaLinux:8aardvark-dns2:1.10.1-2.module_el8.10.0+4047+545787c4ALSA-2026:4672
AlmaLinux:8aardvark-dns2:1.10.1-2.module_el8.10.0+3901+4b80ecd7ALSA-2026:4672
AlmaLinux:8aardvark-dns2:1.10.1-2.module_el8.10.0+3909+6e1c1eb7ALSA-2026:4672
AlmaLinux:8buildah2:1.33.14-3.module_el8.10.0+4136+16425343ALSA-2026:4672
AlmaLinux:8buildah-tests2:1.33.14-3.module_el8.10.0+4136+16425343ALSA-2026:4672
AlmaLinux:8cockpit-podman84.1-1.module_el8.10.0+4102+6c76e544ALSA-2026:4672
AlmaLinux:8conmon3:2.1.10-1.module_el8.10.0+3970+8445edf6ALSA-2026:4672
AlmaLinux:8conmon3:2.1.10-1.module_el8.10.0+4090+91932338ALSA-2026:4672
AlmaLinux:8conmon3:2.1.10-1.module_el8.10.0+4068+0e21408fALSA-2026:4672
AlmaLinux:8container-selinux2:2.229.0-2.module_el8.10.0+4090+91932338ALSA-2026:4672
AlmaLinux:8containernetworking-plugins1:1.4.0-8.module_el8.10.0+4136+16425343ALSA-2026:4672
AlmaLinux:8containers-common2:1-82.module_el8.10.0+3901+4b80ecd7ALSA-2026:4672
AlmaLinux:8containers-common2:1-82.module_el8.10.0+4089+ce72bbbeALSA-2026:4672
AlmaLinux:8containers-common2:1-82.module_el8.10.0+3876+e55593a8ALSA-2026:4672
AlmaLinux:8crit3.18-5.module_el8.10.0+4047+545787c4ALSA-2026:4672
AlmaLinux:8crit3.18-5.module_el8.10.0+3901+4b80ecd7ALSA-2026:4672
AlmaLinux:8crit3.18-5.module_el8.10.0+4120+03ad4b47ALSA-2026:4672
AlmaLinux:8crit3.18-5.module_el8.10.0+3845+87b84552ALSA-2026:4672
AlmaLinux:8criu3.18-5.module_el8.10.0+3876+e55593a8ALSA-2026:4672
AlmaLinux:8criu3.18-5.module_el8.10.0+4089+ce72bbbeALSA-2026:4672
AlmaLinux:8criu3.18-5.module_el8.10.0+3909+6e1c1eb7ALSA-2026:4672
AlmaLinux:8criu3.18-5.module_el8.10.0+4120+03ad4b47ALSA-2026:4672
AlmaLinux:8criu-devel3.18-5.module_el8.10.0+4016+efd18bf8ALSA-2026:4672
AlmaLinux:8criu-devel3.18-5.module_el8.10.0+3858+6ad51f9fALSA-2026:4672
AlmaLinux:8criu-devel3.18-5.module_el8.10.0+4068+0e21408fALSA-2026:4672
AlmaLinux:8criu-devel3.18-5.module_el8.10.0+4089+ce72bbbeALSA-2026:4672
AlmaLinux:8criu-libs3.18-5.module_el8.10.0+4082+f7f0c95eALSA-2026:4672
AlmaLinux:8criu-libs3.18-5.module_el8.10.0+3909+6e1c1eb7ALSA-2026:4672
AlmaLinux:8criu-libs3.18-5.module_el8.10.0+3970+8445edf6ALSA-2026:4672
AlmaLinux:8criu-libs3.18-5.module_el8.10.0+3926+f12484f5ALSA-2026:4672
AlmaLinux:8crun1.14.3-2.module_el8.10.0+4102+6c76e544ALSA-2026:4672
AlmaLinux:8crun1.14.3-2.module_el8.10.0+4120+03ad4b47ALSA-2026:4672
AlmaLinux:8crun1.14.3-2.module_el8.10.0+4082+f7f0c95eALSA-2026:4672
AlmaLinux:8delve1.25.2-1.module_el8.10.0+4074+24330916ALSA-2026:2708
AlmaLinux:8fuse-overlayfs1.13-1.module_el8.10.0+4068+0e21408fALSA-2026:4672
AlmaLinux:8fuse-overlayfs1.13-1.module_el8.10.0+3792+03eaed9cALSA-2026:4672
AlmaLinux:8fuse-overlayfs1.13-1.module_el8.10.0+4082+f7f0c95eALSA-2026:4672
AlmaLinux:8fuse-overlayfs1.13-1.module_el8.10.0+4047+545787c4ALSA-2026:4672
AlmaLinux:8go-toolset1.25.7-1.module_el8.10.0+4117+b694c6c9ALSA-2026:2708
AlmaLinux:9go-toolset1.25.7-1.el9_7ALSA-2026:2709
AlmaLinux:8golang1.25.7-1.module_el8.10.0+4117+b694c6c9ALSA-2026:2708
AlmaLinux:9golang1.25.7-1.el9_7ALSA-2026:2709
AlmaLinux:8golang-bin1.25.7-1.module_el8.10.0+4117+b694c6c9ALSA-2026:2708
AlmaLinux:9golang-bin1.25.7-1.el9_7ALSA-2026:2709
AlmaLinux:10golang-docs1.25.7-1.el10_1.alma.1ALSA-2026:2706
AlmaLinux:8golang-docs1.25.7-1.module_el8.10.0+4117+b694c6c9ALSA-2026:2708
AlmaLinux:9golang-docs1.25.7-1.el9_7ALSA-2026:2709
AlmaLinux:10golang-misc1.25.7-1.el10_1.alma.1ALSA-2026:2706
AlmaLinux:8golang-misc1.25.7-1.module_el8.10.0+4117+b694c6c9ALSA-2026:2708
AlmaLinux:9golang-misc1.25.7-1.el9_7ALSA-2026:2709
AlmaLinux:8golang-race1.25.7-1.module_el8.10.0+4117+b694c6c9ALSA-2026:2708
AlmaLinux:9golang-race1.25.7-1.el9_7ALSA-2026:2709
AlmaLinux:10golang-src1.25.7-1.el10_1.alma.1ALSA-2026:2706
AlmaLinux:8golang-src1.25.7-1.module_el8.10.0+4117+b694c6c9ALSA-2026:2708
AlmaLinux:9golang-src1.25.7-1.el9_7ALSA-2026:2709
AlmaLinux:10golang-tests1.25.7-1.el10_1.alma.1ALSA-2026:2706
AlmaLinux:8golang-tests1.25.7-1.module_el8.10.0+4117+b694c6c9ALSA-2026:2708
AlmaLinux:9golang-tests1.25.7-1.el9_7ALSA-2026:2709
AlmaLinux:10grafana10.2.6-22.el10_1ALSA-2026:2914
AlmaLinux:8grafana9.2.10-28.el8_10ALSA-2026:3188
AlmaLinux:9grafana10.2.6-18.el9_7ALSA-2026:2920
AlmaLinux:10grafana-selinux10.2.6-22.el10_1ALSA-2026:2914
AlmaLinux:8grafana-selinux9.2.10-28.el8_10ALSA-2026:3188
AlmaLinux:9grafana-selinux10.2.6-18.el9_7ALSA-2026:2920
AlmaLinux:8libslirp4.4.0-2.module_el8.10.0+4023+db236c53ALSA-2026:4672
AlmaLinux:8libslirp4.4.0-2.module_el8.10.0+4120+03ad4b47ALSA-2026:4672
AlmaLinux:8libslirp4.4.0-2.module_el8.10.0+4089+ce72bbbeALSA-2026:4672
AlmaLinux:8libslirp4.4.0-2.module_el8.10.0+4090+91932338ALSA-2026:4672
AlmaLinux:8libslirp-devel4.4.0-2.module_el8.10.0+4102+6c76e544ALSA-2026:4672
AlmaLinux:8libslirp-devel4.4.0-2.module_el8.10.0+4082+f7f0c95eALSA-2026:4672
AlmaLinux:8libslirp-devel4.4.0-2.module_el8.10.0+3970+8445edf6ALSA-2026:4672
AlmaLinux:8libslirp-devel4.4.0-2.module_el8.10.0+4068+0e21408fALSA-2026:4672
AlmaLinux:8netavark2:1.10.3-1.module_el8.10.0+4120+03ad4b47ALSA-2026:4672
AlmaLinux:8netavark2:1.10.3-1.module_el8.10.0+4082+f7f0c95eALSA-2026:4672
AlmaLinux:8netavark2:1.10.3-1.module_el8.10.0+3970+8445edf6ALSA-2026:4672
AlmaLinux:8netavark2:1.10.3-1.module_el8.10.0+4023+db236c53ALSA-2026:4672
AlmaLinux:8oci-seccomp-bpf-hook1.2.10-1.module_el8.10.0+4047+545787c4ALSA-2026:4672
AlmaLinux:8oci-seccomp-bpf-hook1.2.10-1.module_el8.10.0+3909+6e1c1eb7ALSA-2026:4672
AlmaLinux:8oci-seccomp-bpf-hook1.2.10-1.module_el8.10.0+4068+0e21408fALSA-2026:4672
AlmaLinux:8oci-seccomp-bpf-hook1.2.10-1.module_el8.10.0+4120+03ad4b47ALSA-2026:4672
AlmaLinux:10osbuild-composer149-5.el10_1.alma.3ALSA-2026:3752
AlmaLinux:9osbuild-composer149-4.el9_7.alma.3ALSA-2026:3753
AlmaLinux:10osbuild-composer-core149-5.el10_1.alma.3ALSA-2026:3752
AlmaLinux:9osbuild-composer-core149-4.el9_7.alma.3ALSA-2026:3753
AlmaLinux:10osbuild-composer-worker149-5.el10_1.alma.3ALSA-2026:3752
AlmaLinux:9osbuild-composer-worker149-4.el9_7.alma.3ALSA-2026:3753
AlmaLinux:8podman4:4.9.4-30.module_el8.10.0+4136+16425343ALSA-2026:4672
AlmaLinux:9podman6:5.6.0-14.el9_7ALSA-2026:3337
AlmaLinux:8podman-catatonit4:4.9.4-30.module_el8.10.0+4136+16425343ALSA-2026:4672
AlmaLinux:10podman-docker7:5.6.0-12.el10_1.alma.1ALSA-2026:3336
AlmaLinux:8podman-docker4:4.9.4-30.module_el8.10.0+4136+16425343ALSA-2026:4672
AlmaLinux:9podman-docker6:5.6.0-14.el9_7ALSA-2026:3337
AlmaLinux:8podman-gvproxy4:4.9.4-30.module_el8.10.0+4136+16425343ALSA-2026:4672
AlmaLinux:8podman-plugins4:4.9.4-30.module_el8.10.0+4136+16425343ALSA-2026:4672
AlmaLinux:9podman-plugins6:5.6.0-14.el9_7ALSA-2026:3337
AlmaLinux:8podman-remote4:4.9.4-30.module_el8.10.0+4136+16425343ALSA-2026:4672
AlmaLinux:9podman-remote6:5.6.0-14.el9_7ALSA-2026:3337
AlmaLinux:8podman-tests4:4.9.4-30.module_el8.10.0+4136+16425343ALSA-2026:4672
AlmaLinux:9podman-tests6:5.6.0-14.el9_7ALSA-2026:3337
AlmaLinux:8python3-criu3.18-5.module_el8.10.0+3970+8445edf6ALSA-2026:4672
AlmaLinux:8python3-criu3.18-5.module_el8.10.0+3901+4b80ecd7ALSA-2026:4672
AlmaLinux:8python3-criu3.18-5.module_el8.10.0+4120+03ad4b47ALSA-2026:4672
AlmaLinux:8python3-criu3.18-5.module_el8.10.0+3876+e55593a8ALSA-2026:4672
AlmaLinux:8python3-podman4.9.0-3.module_el8.10.0+4016+efd18bf8ALSA-2026:4672
AlmaLinux:8runc4:1.2.9-4.module_el8.10.0+4136+16425343ALSA-2026:4672
AlmaLinux:8skopeo2:1.14.5-7.module_el8.10.0+4136+16425343ALSA-2026:4672
AlmaLinux:8skopeo-tests2:1.14.5-7.module_el8.10.0+4136+16425343ALSA-2026:4672
AlmaLinux:8slirp4netns1.2.3-1.module_el8.10.0+4047+545787c4ALSA-2026:4672
AlmaLinux:8slirp4netns1.2.3-1.module_el8.10.0+4023+db236c53ALSA-2026:4672
AlmaLinux:8slirp4netns1.2.3-1.module_el8.10.0+3926+f12484f5ALSA-2026:4672
AlmaLinux:8slirp4netns1.2.3-1.module_el8.10.0+4082+f7f0c95eALSA-2026:4672
AlmaLinux:8toolbox0.0.99.5.1-1.module_el8.10.0+4120+03ad4b47ALSA-2026:4672
AlmaLinux:8toolbox-tests0.0.99.5.1-1.module_el8.10.0+4120+03ad4b47ALSA-2026:4672
AlmaLinux:8udica0.2.6-21.module_el8.10.0+4068+0e21408fALSA-2026:4672
Alpine:v3.22go1.24.12-r0ALPINE-CVE-2025-61728
Alpine:v3.23go1.25.6-r0ALPINE-CVE-2025-61728
Alpine:v3.24go1.25.6-r0ALPINE-CVE-2025-61728
Alpine:v3.24opentofu1.11.4-r0ALPINE-CVE-2025-61728
Debian:12golang-1.19no fix listedDEBIAN-CVE-2025-61728
Debian:13golang-1.24no fix listedDEBIAN-CVE-2025-61728
Gostdlib1.24.12, 1.25.6GO-2026-4342
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+40047+0c0a73f4RLSA-2026:4672
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+2001+6a33db9fRLSA-2026:4672
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+1948+4b5cd4a9RLSA-2026:4672
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+1896+b18fa106RLSA-2026:4672
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+1874+ce489889RLSA-2026:4672
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+1880+8e896d1bRLSA-2026:4672
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1815+5fe7415eRLSA-2026:4672
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1874+ce489889RLSA-2026:4672
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1880+8e896d1bRLSA-2026:4672
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1896+b18fa106RLSA-2026:4672
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1948+4b5cd4a9RLSA-2026:4672
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+2001+6a33db9fRLSA-2026:4672
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1843+6892ab28RLSA-2026:4672
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1872+2e18eb19RLSA-2026:4672
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+40047+0c0a73f4RLSA-2026:4672
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1825+623b0c20RLSA-2026:4672
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1896+b18fa106RLSA-2026:4672
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1948+4b5cd4a9RLSA-2026:4672
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+40047+0c0a73f4RLSA-2026:4672
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1843+6892ab28RLSA-2026:4672
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1872+2e18eb19RLSA-2026:4672
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1874+ce489889RLSA-2026:4672
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1880+8e896d1bRLSA-2026:4672
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1815+5fe7415eRLSA-2026:4672
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+2001+6a33db9fRLSA-2026:4672
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1948+4b5cd4a9RLSA-2026:4672
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1815+5fe7415eRLSA-2026:4672
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1825+623b0c20RLSA-2026:4672
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1843+6892ab28RLSA-2026:4672
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1872+2e18eb19RLSA-2026:4672
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+40047+0c0a73f4RLSA-2026:4672
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1874+ce489889RLSA-2026:4672
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1880+8e896d1bRLSA-2026:4672
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1896+b18fa106RLSA-2026:4672
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+2001+6a33db9fRLSA-2026:4672
Rocky Linux:8containers-common2:1-82.module+el8.10.0+40047+0c0a73f4RLSA-2026:4672
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1872+2e18eb19RLSA-2026:4672
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1874+ce489889RLSA-2026:4672
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1880+8e896d1bRLSA-2026:4672
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1948+4b5cd4a9RLSA-2026:4672
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1896+b18fa106RLSA-2026:4672
Rocky Linux:8containers-common2:1-82.module+el8.10.0+2001+6a33db9fRLSA-2026:4672
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1843+6892ab28RLSA-2026:4672
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1815+5fe7415eRLSA-2026:4672
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1896+b18fa106RLSA-2026:4672
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1880+8e896d1bRLSA-2026:4672
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1874+ce489889RLSA-2026:4672
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1872+2e18eb19RLSA-2026:4672
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1948+4b5cd4a9RLSA-2026:4672
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1843+6892ab28RLSA-2026:4672
Rocky Linux:8criu0:3.18-5.module+el8.10.0+40047+0c0a73f4RLSA-2026:4672
Rocky Linux:8criu0:3.18-5.module+el8.10.0+2001+6a33db9fRLSA-2026:4672
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1825+623b0c20RLSA-2026:4672
Rocky Linux:8crun0:1.14.3-2.module+el8.10.0+1874+ce489889RLSA-2026:4672
Rocky Linux:8crun0:1.14.3-2.module+el8.10.0+40047+0c0a73f4RLSA-2026:4672
Rocky Linux:8crun0:1.14.3-2.module+el8.10.0+2001+6a33db9fRLSA-2026:4672
Rocky Linux:8crun0:1.14.3-2.module+el8.10.0+1948+4b5cd4a9RLSA-2026:4672
Rocky Linux:8crun0:1.14.3-2.module+el8.10.0+1815+5fe7415eRLSA-2026:4672
Rocky Linux:8crun0:1.14.3-2.module+el8.10.0+1825+623b0c20RLSA-2026:4672
Rocky Linux:8crun0:1.14.3-2.module+el8.10.0+1896+b18fa106RLSA-2026:4672
Rocky Linux:8crun0:1.14.3-2.module+el8.10.0+1880+8e896d1bRLSA-2026:4672
Rocky Linux:8crun0:1.14.3-2.module+el8.10.0+1872+2e18eb19RLSA-2026:4672
Rocky Linux:8crun0:1.14.3-2.module+el8.10.0+1843+6892ab28RLSA-2026:4672
Rocky Linux:8delve0:1.25.2-1.module+el8.10.0+40035+ee0a7047RLSA-2026:2708
Rocky Linux:8fuse-overlayfs0:1.13-1.module+el8.10.0+2001+6a33db9fRLSA-2026:4672
Rocky Linux:8fuse-overlayfs0:1.13-1.module+el8.10.0+1896+b18fa106RLSA-2026:4672
Rocky Linux:8fuse-overlayfs0:1.13-1.module+el8.10.0+1815+5fe7415eRLSA-2026:4672
Rocky Linux:8fuse-overlayfs0:1.13-1.module+el8.10.0+1874+ce489889RLSA-2026:4672
Rocky Linux:8fuse-overlayfs0:1.13-1.module+el8.10.0+1825+623b0c20RLSA-2026:4672
Rocky Linux:8fuse-overlayfs0:1.13-1.module+el8.10.0+1843+6892ab28RLSA-2026:4672
Rocky Linux:8fuse-overlayfs0:1.13-1.module+el8.10.0+1872+2e18eb19RLSA-2026:4672
Rocky Linux:8fuse-overlayfs0:1.13-1.module+el8.10.0+40047+0c0a73f4RLSA-2026:4672
Rocky Linux:8fuse-overlayfs0:1.13-1.module+el8.10.0+1948+4b5cd4a9RLSA-2026:4672
Rocky Linux:8fuse-overlayfs0:1.13-1.module+el8.10.0+1880+8e896d1bRLSA-2026:4672
Rocky Linux:10golang0:1.25.7-1.el10_1RLSA-2026:2706
Rocky Linux:8golang0:1.25.7-1.module+el8.10.0+40081+47cbcb72RLSA-2026:2708
Rocky Linux:9golang0:1.25.7-1.el9_7RLSA-2026:2709
Rocky Linux:10grafana0:10.2.6-22.el10_1RLSA-2026:2914

Affected products (as reported)

VendorProductVersions
Go standard library archive/zip 0 – before 1.24.121.25.0 – before 1.25.6

References