Vulnerability · Published Dec 2, 2025 · Assigned by Go

CVE-2025-61729Excessive resource consumption when printing error string for host certificate validation in crypto/x509

High 7.5

In plain English

A high-severity security flaw in crypto/x509 from Go standard library. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 57.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8aardvark-dns2:1.10.1-2.module_el8.10.0+3909+6e1c1eb7ALSA-2026:3428
AlmaLinux:8aardvark-dns2:1.10.1-2.module_el8.10.0+4089+ce72bbbeALSA-2026:3428
AlmaLinux:8aardvark-dns2:1.10.1-2.module_el8.10.0+4047+545787c4ALSA-2026:3428
AlmaLinux:8aardvark-dns2:1.10.1-2.module_el8.10.0+3901+4b80ecd7ALSA-2026:3428
AlmaLinux:10buildah2:1.41.8-2.el10_1ALSA-2026:3297
AlmaLinux:8buildah2:1.33.14-2.module_el8.10.0+4120+03ad4b47ALSA-2026:3428
AlmaLinux:9buildah2:1.41.8-2.el9_7ALSA-2026:3298
AlmaLinux:10buildah-tests2:1.41.8-2.el10_1ALSA-2026:3297
AlmaLinux:8buildah-tests2:1.33.14-2.module_el8.10.0+4120+03ad4b47ALSA-2026:3428
AlmaLinux:9buildah-tests2:1.41.8-2.el9_7ALSA-2026:3298
AlmaLinux:8cockpit-podman84.1-1.module_el8.10.0+4102+6c76e544ALSA-2026:3428
AlmaLinux:8conmon3:2.1.10-1.module_el8.10.0+4068+0e21408fALSA-2026:3428
AlmaLinux:8conmon3:2.1.10-1.module_el8.10.0+3970+8445edf6ALSA-2026:3428
AlmaLinux:8conmon3:2.1.10-1.module_el8.10.0+4090+91932338ALSA-2026:3428
AlmaLinux:8container-selinux2:2.229.0-2.module_el8.10.0+4090+91932338ALSA-2026:3428
AlmaLinux:8containernetworking-plugins1:1.4.0-7.module_el8.10.0+4120+03ad4b47ALSA-2026:3428
AlmaLinux:9containernetworking-plugins1:1.9.0-2.el9ALSA-2026:18913
AlmaLinux:9containernetworking-plugins1:1.7.1-3.el9_7ALSA-2026:3341
AlmaLinux:8containers-common2:1-82.module_el8.10.0+3901+4b80ecd7ALSA-2026:3428
AlmaLinux:8containers-common2:1-82.module_el8.10.0+3876+e55593a8ALSA-2026:3428
AlmaLinux:8containers-common2:1-82.module_el8.10.0+4089+ce72bbbeALSA-2026:3428
AlmaLinux:8crit3.18-5.module_el8.10.0+4047+545787c4ALSA-2026:3428
AlmaLinux:8crit3.18-5.module_el8.10.0+3901+4b80ecd7ALSA-2026:3428
AlmaLinux:8crit3.18-5.module_el8.10.0+4120+03ad4b47ALSA-2026:3428
AlmaLinux:8crit3.18-5.module_el8.10.0+3845+87b84552ALSA-2026:3428
AlmaLinux:8criu3.18-5.module_el8.10.0+3909+6e1c1eb7ALSA-2026:3428
AlmaLinux:8criu3.18-5.module_el8.10.0+4120+03ad4b47ALSA-2026:3428
AlmaLinux:8criu3.18-5.module_el8.10.0+4089+ce72bbbeALSA-2026:3428
AlmaLinux:8criu3.18-5.module_el8.10.0+3876+e55593a8ALSA-2026:3428
AlmaLinux:8criu-devel3.18-5.module_el8.10.0+4016+efd18bf8ALSA-2026:3428
AlmaLinux:8criu-devel3.18-5.module_el8.10.0+4089+ce72bbbeALSA-2026:3428
AlmaLinux:8criu-devel3.18-5.module_el8.10.0+4068+0e21408fALSA-2026:3428
AlmaLinux:8criu-devel3.18-5.module_el8.10.0+3858+6ad51f9fALSA-2026:3428
AlmaLinux:8criu-libs3.18-5.module_el8.10.0+3909+6e1c1eb7ALSA-2026:3428
AlmaLinux:8criu-libs3.18-5.module_el8.10.0+3970+8445edf6ALSA-2026:3428
AlmaLinux:8criu-libs3.18-5.module_el8.10.0+3926+f12484f5ALSA-2026:3428
AlmaLinux:8criu-libs3.18-5.module_el8.10.0+4082+f7f0c95eALSA-2026:3428
AlmaLinux:8crun1.14.3-2.module_el8.10.0+4082+f7f0c95eALSA-2026:3428
AlmaLinux:8crun1.14.3-2.module_el8.10.0+4120+03ad4b47ALSA-2026:3428
AlmaLinux:8crun1.14.3-2.module_el8.10.0+4102+6c76e544ALSA-2026:3428
AlmaLinux:10delve1.25.2-2.el10_1ALSA-2026:3864
AlmaLinux:10delve1.26.1-1.el10_2ALSA-2026:19013
AlmaLinux:8delve1.25.2-1.module_el8.10.0+4074+24330916ALSA-2026:0921
AlmaLinux:8fuse-overlayfs1.13-1.module_el8.10.0+4047+545787c4ALSA-2026:3428
AlmaLinux:8fuse-overlayfs1.13-1.module_el8.10.0+3792+03eaed9cALSA-2026:3428
AlmaLinux:8fuse-overlayfs1.13-1.module_el8.10.0+4082+f7f0c95eALSA-2026:3428
AlmaLinux:8fuse-overlayfs1.13-1.module_el8.10.0+4068+0e21408fALSA-2026:3428
AlmaLinux:10git-lfs3.6.1-7.el10_1ALSA-2026:4164
AlmaLinux:8git-lfs3.4.1-7.el8_10ALSA-2026:2323
AlmaLinux:9git-lfs3.6.1-7.el9_7ALSA-2026:3928
AlmaLinux:8go-toolset1.25.5-1.module_el8.10.0+4107+b32a33ceALSA-2026:0921
AlmaLinux:9go-toolset1.25.5-2.el9_7ALSA-2026:0923
AlmaLinux:8golang1.25.5-1.module_el8.10.0+4107+b32a33ceALSA-2026:0921
AlmaLinux:9golang1.25.5-2.el9_7ALSA-2026:0923
AlmaLinux:8golang-bin1.25.5-1.module_el8.10.0+4107+b32a33ceALSA-2026:0921
AlmaLinux:9golang-bin1.25.5-2.el9_7ALSA-2026:0923
AlmaLinux:10golang-docs1.25.5-1.el10_1.alma.1ALSA-2026:0922
AlmaLinux:8golang-docs1.25.5-1.module_el8.10.0+4107+b32a33ceALSA-2026:0921
AlmaLinux:9golang-docs1.25.5-2.el9_7ALSA-2026:0923
AlmaLinux:10golang-misc1.25.5-1.el10_1.alma.1ALSA-2026:0922
AlmaLinux:8golang-misc1.25.5-1.module_el8.10.0+4107+b32a33ceALSA-2026:0921
AlmaLinux:9golang-misc1.25.5-2.el9_7ALSA-2026:0923
AlmaLinux:8golang-race1.25.5-1.module_el8.10.0+4107+b32a33ceALSA-2026:0921
AlmaLinux:9golang-race1.25.5-2.el9_7ALSA-2026:0923
AlmaLinux:10golang-src1.25.5-1.el10_1.alma.1ALSA-2026:0922
AlmaLinux:8golang-src1.25.5-1.module_el8.10.0+4107+b32a33ceALSA-2026:0921
AlmaLinux:9golang-src1.25.5-2.el9_7ALSA-2026:0923
AlmaLinux:10golang-tests1.25.5-1.el10_1.alma.1ALSA-2026:0922
AlmaLinux:8golang-tests1.25.5-1.module_el8.10.0+4107+b32a33ceALSA-2026:0921
AlmaLinux:9golang-tests1.25.5-2.el9_7ALSA-2026:0923
AlmaLinux:10grafana10.2.6-22.el10_1ALSA-2026:2914
AlmaLinux:8grafana9.2.10-27.el8_10ALSA-2026:1344
AlmaLinux:9grafana10.2.6-18.el9_7ALSA-2026:2920
AlmaLinux:10grafana-pcp5.3.0-2.el10_1ALSA-2026:3035
AlmaLinux:8grafana-pcp5.1.1-11.el8_10ALSA-2026:1518
AlmaLinux:9grafana-pcp5.1.1-12.el9_7ALSA-2026:3040
AlmaLinux:10grafana-selinux10.2.6-22.el10_1ALSA-2026:2914
AlmaLinux:8grafana-selinux9.2.10-27.el8_10ALSA-2026:1344
AlmaLinux:9grafana-selinux10.2.6-18.el9_7ALSA-2026:2920
AlmaLinux:10image-builder31-4.el10_1ALSA-2026:3840
AlmaLinux:9image-builder31-3.el9_7ALSA-2026:3839
AlmaLinux:10ipp-usb0.9.27-4.el10_1ALSA-2026:1715
AlmaLinux:8libslirp4.4.0-2.module_el8.10.0+4023+db236c53ALSA-2026:3428
AlmaLinux:8libslirp4.4.0-2.module_el8.10.0+4120+03ad4b47ALSA-2026:3428
AlmaLinux:8libslirp4.4.0-2.module_el8.10.0+4089+ce72bbbeALSA-2026:3428
AlmaLinux:8libslirp4.4.0-2.module_el8.10.0+4090+91932338ALSA-2026:3428
AlmaLinux:8libslirp-devel4.4.0-2.module_el8.10.0+4102+6c76e544ALSA-2026:3428
AlmaLinux:8libslirp-devel4.4.0-2.module_el8.10.0+4068+0e21408fALSA-2026:3428
AlmaLinux:8libslirp-devel4.4.0-2.module_el8.10.0+3970+8445edf6ALSA-2026:3428
AlmaLinux:8libslirp-devel4.4.0-2.module_el8.10.0+4082+f7f0c95eALSA-2026:3428
AlmaLinux:8netavark2:1.10.3-1.module_el8.10.0+4023+db236c53ALSA-2026:3428
AlmaLinux:8netavark2:1.10.3-1.module_el8.10.0+4120+03ad4b47ALSA-2026:3428
AlmaLinux:8netavark2:1.10.3-1.module_el8.10.0+4082+f7f0c95eALSA-2026:3428
AlmaLinux:8netavark2:1.10.3-1.module_el8.10.0+3970+8445edf6ALSA-2026:3428
AlmaLinux:8oci-seccomp-bpf-hook1.2.10-1.module_el8.10.0+4047+545787c4ALSA-2026:3428
AlmaLinux:8oci-seccomp-bpf-hook1.2.10-1.module_el8.10.0+4068+0e21408fALSA-2026:3428
AlmaLinux:8oci-seccomp-bpf-hook1.2.10-1.module_el8.10.0+3909+6e1c1eb7ALSA-2026:3428
AlmaLinux:8oci-seccomp-bpf-hook1.2.10-1.module_el8.10.0+4120+03ad4b47ALSA-2026:3428
AlmaLinux:10opentelemetry-collector0.135.0-3.el10_1ALSA-2026:1907
AlmaLinux:9opentelemetry-collector0.135.0-3.el9_7ALSA-2026:1908
AlmaLinux:10osbuild-composer149-5.el10_1.alma.3ALSA-2026:3752
AlmaLinux:8osbuild-composer101.4-3.el8_10.alma.1ALSA-2026:2124
AlmaLinux:9osbuild-composer149-4.el9_7.alma.3ALSA-2026:3753
AlmaLinux:10osbuild-composer-core149-5.el10_1.alma.3ALSA-2026:3752
AlmaLinux:8osbuild-composer-core101.4-3.el8_10.alma.1ALSA-2026:2124
AlmaLinux:9osbuild-composer-core149-4.el9_7.alma.3ALSA-2026:3753
AlmaLinux:10osbuild-composer-worker149-5.el10_1.alma.3ALSA-2026:3752
AlmaLinux:8osbuild-composer-worker101.4-3.el8_10.alma.1ALSA-2026:2124
AlmaLinux:9osbuild-composer-worker149-4.el9_7.alma.3ALSA-2026:3753
AlmaLinux:8podman4:4.9.4-28.module_el8.10.0+4120+03ad4b47ALSA-2026:3428
AlmaLinux:9podman6:5.6.0-14.el9_7ALSA-2026:3337
AlmaLinux:8podman-catatonit4:4.9.4-28.module_el8.10.0+4120+03ad4b47ALSA-2026:3428
AlmaLinux:10podman-docker7:5.6.0-12.el10_1.alma.1ALSA-2026:3336
AlmaLinux:8podman-docker4:4.9.4-28.module_el8.10.0+4120+03ad4b47ALSA-2026:3428
AlmaLinux:9podman-docker6:5.6.0-14.el9_7ALSA-2026:3337
AlmaLinux:8podman-gvproxy4:4.9.4-28.module_el8.10.0+4120+03ad4b47ALSA-2026:3428
AlmaLinux:8podman-plugins4:4.9.4-28.module_el8.10.0+4120+03ad4b47ALSA-2026:3428
AlmaLinux:9podman-plugins6:5.6.0-14.el9_7ALSA-2026:3337
AlmaLinux:8podman-remote4:4.9.4-28.module_el8.10.0+4120+03ad4b47ALSA-2026:3428
AlmaLinux:9podman-remote6:5.6.0-14.el9_7ALSA-2026:3337
AlmaLinux:8podman-tests4:4.9.4-28.module_el8.10.0+4120+03ad4b47ALSA-2026:3428
AlmaLinux:9podman-tests6:5.6.0-14.el9_7ALSA-2026:3337
AlmaLinux:8python3-criu3.18-5.module_el8.10.0+3970+8445edf6ALSA-2026:3428
AlmaLinux:8python3-criu3.18-5.module_el8.10.0+4120+03ad4b47ALSA-2026:3428
AlmaLinux:8python3-criu3.18-5.module_el8.10.0+3876+e55593a8ALSA-2026:3428
AlmaLinux:8python3-criu3.18-5.module_el8.10.0+3901+4b80ecd7ALSA-2026:3428
AlmaLinux:8python3-podman4.9.0-3.module_el8.10.0+4016+efd18bf8ALSA-2026:3428
AlmaLinux:8runc4:1.2.9-3.module_el8.10.0+4120+03ad4b47ALSA-2026:3428
AlmaLinux:9runc4:1.4.0-2.el9_7ALSA-2026:3291
AlmaLinux:10skopeo2:1.20.0-3.el10_1ALSA-2026:3343
AlmaLinux:8skopeo2:1.14.5-6.module_el8.10.0+4120+03ad4b47ALSA-2026:3428
AlmaLinux:9skopeo2:1.20.0-3.el9_7ALSA-2026:3340
AlmaLinux:10skopeo-tests2:1.20.0-3.el10_1ALSA-2026:3343
AlmaLinux:8skopeo-tests2:1.14.5-6.module_el8.10.0+4120+03ad4b47ALSA-2026:3428
AlmaLinux:9skopeo-tests2:1.20.0-3.el9_7ALSA-2026:3340
AlmaLinux:8slirp4netns1.2.3-1.module_el8.10.0+3926+f12484f5ALSA-2026:3428
AlmaLinux:8slirp4netns1.2.3-1.module_el8.10.0+4023+db236c53ALSA-2026:3428
AlmaLinux:8slirp4netns1.2.3-1.module_el8.10.0+4047+545787c4ALSA-2026:3428
AlmaLinux:8slirp4netns1.2.3-1.module_el8.10.0+4082+f7f0c95eALSA-2026:3428
AlmaLinux:8toolbox0.0.99.5.1-1.module_el8.10.0+4120+03ad4b47ALSA-2026:3428
AlmaLinux:8toolbox-tests0.0.99.5.1-1.module_el8.10.0+4120+03ad4b47ALSA-2026:3428
AlmaLinux:8udica0.2.6-21.module_el8.10.0+4068+0e21408fALSA-2026:3428
AlmaLinux:10yggdrasil0.4.8-3.el10_1ALSA-2026:5146
AlmaLinux:10yggdrasil-devel0.4.8-3.el10_1ALSA-2026:5146
Alpine:v3.23docker29.1.2-r0ALPINE-CVE-2025-61729
Alpine:v3.24docker29.1.2-r0ALPINE-CVE-2025-61729
Alpine:v3.22go1.24.11-r0ALPINE-CVE-2025-61729
Alpine:v3.23go1.25.5-r0ALPINE-CVE-2025-61729
Alpine:v3.24go1.25.5-r0ALPINE-CVE-2025-61729
Alpine:v3.23rclone1.72.1-r0ALPINE-CVE-2025-61729
Alpine:v3.24rclone1.72.1-r0ALPINE-CVE-2025-61729
Debian:12golang-1.19no fix listedDEBIAN-CVE-2025-61729
Debian:13golang-1.24no fix listedDEBIAN-CVE-2025-61729
Gostdlib1.24.11, 1.25.5GO-2025-4155
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+1896+b18fa106RLSA-2026:3428
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+1874+ce489889RLSA-2026:3428
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+2001+6a33db9fRLSA-2026:3428
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+1948+4b5cd4a9RLSA-2026:3428
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+1880+8e896d1bRLSA-2026:3428
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+40047+0c0a73f4RLSA-2026:3428
Rocky Linux:10buildah2:1.41.8-2.el10_1RLSA-2026:3297
Rocky Linux:8buildah2:1.33.14-2.module+el8.10.0+40087+cfe9c127RLSA-2026:3428
Rocky Linux:9buildah2:1.41.8-2.el9_7RLSA-2026:3298
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1880+8e896d1bRLSA-2026:3428
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1815+5fe7415eRLSA-2026:3428
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1896+b18fa106RLSA-2026:3428
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+2001+6a33db9fRLSA-2026:3428
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+40047+0c0a73f4RLSA-2026:3428
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1843+6892ab28RLSA-2026:3428
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1825+623b0c20RLSA-2026:3428
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1948+4b5cd4a9RLSA-2026:3428
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1872+2e18eb19RLSA-2026:3428
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1874+ce489889RLSA-2026:3428
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1880+8e896d1bRLSA-2026:3428
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1896+b18fa106RLSA-2026:3428
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+2001+6a33db9fRLSA-2026:3428
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1872+2e18eb19RLSA-2026:3428
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1948+4b5cd4a9RLSA-2026:3428
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1815+5fe7415eRLSA-2026:3428
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1843+6892ab28RLSA-2026:3428
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+40047+0c0a73f4RLSA-2026:3428
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1874+ce489889RLSA-2026:3428
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1880+8e896d1bRLSA-2026:3428
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+40047+0c0a73f4RLSA-2026:3428
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+2001+6a33db9fRLSA-2026:3428
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1896+b18fa106RLSA-2026:3428
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1872+2e18eb19RLSA-2026:3428
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1874+ce489889RLSA-2026:3428
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1815+5fe7415eRLSA-2026:3428
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1948+4b5cd4a9RLSA-2026:3428
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1825+623b0c20RLSA-2026:3428
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1843+6892ab28RLSA-2026:3428
Rocky Linux:8containernetworking-plugins1:1.4.0-7.module+el8.10.0+40087+cfe9c127RLSA-2026:3428
Rocky Linux:9containernetworking-plugins1:1.7.1-3.el9_7RLSA-2026:3341
Rocky Linux:9containernetworking-plugins1:1.9.0-2.el9RLSA-2026:18913
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1880+8e896d1bRLSA-2026:3428
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1948+4b5cd4a9RLSA-2026:3428
Rocky Linux:8containers-common2:1-82.module+el8.10.0+2001+6a33db9fRLSA-2026:3428
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1843+6892ab28RLSA-2026:3428
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1874+ce489889RLSA-2026:3428

Affected products (as reported)

VendorProductVersions
Go standard library crypto/x509 0 – before 1.24.111.25.0 – before 1.25.5

References