Skip to content
Heist/ feed
Back to feed
High

Excessive resource consumption when printing error string for host certificate validation in crypto/x509

Type: advisorySources: OSV

Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2025-61729
Confirmed fixed CVEs
Not specified
Updated in this feed
2 Nov 2026, 19:41 UTC · Revision 1

Source evidence

Excessive resource consumption when printing error string for host certificate validation in crypto/x509

core-osv · Original source

Published 2 Dec 2025, 18:54 UTC

Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.

osv:CVE-2025-61729
Complete source record
{
  "id": "0747ee35143f82da8377e6eab929c0c4be9f1ed2d4d9b0aa1534bd855c75e6a0",
  "url": "https://osv.dev/vulnerability/CVE-2025-61729",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Excessive resource consumption when printing error string for host certificate validation in crypto/x509",
    "summary": "Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.",
    "evidence": "osv:CVE-2025-61729",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2025-61729",
      "aliases": [
        "BIT-golang-2025-61729",
        "CVE-2025-61729",
        "GO-2025-4155"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/golang/go",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "1296453960bac0fb5675853c40e3747e5237e16e"
                },
                {
                  "introduced": "6e676ab2b809d46623acb5988248d95d1eb7939c"
                },
                {
                  "fixed": "fefb02adf45c4bcc879bd406a8d61f2a292c26a9"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.24.11"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "1.25.0"
                      },
                      {
                        "fixed": "1.25.5"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "go1.24.10",
            "go1.25.4",
            "go1.24.9",
            "go1.25.3",
            "go1.24.8",
            "go1.25.2",
            "go1.24.7",
            "go1.25.1",
            "go1.24.6",
            "go1.25.0",
            "go1.24.5",
            "go1.24.4",
            "go1.24.3",
            "go1.24.2",
            "go1.24.1",
            "go1.24.0",
            "go1.24rc3",
            "go1.24rc2",
            "go1.24rc1",
            "go1.19beta1",
            "go1.18beta2",
            "go1.18beta1",
            "go1.17beta1",
            "go1.16beta1",
            "go1.15beta1",
            "go1.14beta1",
            "go1.13beta1",
            "go1.12beta2",
            "go1.12beta1",
            "go1.11beta3",
            "go1.11beta2",
            "go1.11beta1",
            "go1.10rc2",
            "go1.10rc1",
            "go1.10beta2",
            "go1.10beta1",
            "go1.9beta2",
            "go1.9beta1",
            "go1.8beta2",
            "go1.8beta1",
            "go1.7rc4",
            "go1.7rc3",
            "go1.7rc2",
            "go1.7rc1",
            "go1.7beta2",
            "go1.7beta1",
            "go1.6beta2",
            "go1.6beta1",
            "go1.5beta3",
            "go1.5beta2",
            "go1.5beta1",
            "go1.4beta1",
            "go1.3beta2",
            "go1.3beta1",
            "weekly.2012-03-27",
            "weekly",
            "weekly.2012-03-22",
            "weekly.2012-03-13",
            "weekly.2012-03-04",
            "weekly.2012-02-22",
            "weekly.2012-02-14",
            "weekly.2012-02-07",
            "weekly.2012-01-27",
            "weekly.2012-01-20",
            "weekly.2012-01-15",
            "weekly.2011-12-22",
            "weekly.2011-12-14",
            "weekly.2011-12-06",
            "weekly.2011-12-02",
            "weekly.2011-12-01",
            "weekly.2011-11-18",
            "weekly.2011-11-09",
            "weekly.2011-11-08",
            "weekly.2011-11-02",
            "weekly.2011-11-01",
            "weekly.2011-10-26",
            "weekly.2011-10-25",
            "weekly.2011-10-18",
            "weekly.2011-10-06",
            "weekly.2011-09-21",
            "weekly.2011-09-16",
            "weekly.2011-08-17",
            "weekly.2011-09-07",
            "weekly.2011-09-01",
            "weekly.2011-08-10",
            "weekly.2011-07-07",
            "weekly.2011-07-29",
            "weekly.2011-07-19",
            "weekly.2011-06-09",
            "weekly.2011-06-23",
            "weekly.2011-06-16",
            "weekly.2011-06-02",
            "weekly.2011-05-22",
            "weekly.2011-04-27",
            "weekly.2011-04-13",
            "weekly.2011-04-04",
            "weekly.2011-03-28",
            "weekly.2011-03-15",
            "weekly.2011-03-07.1",
            "release.r56",
            "weekly.2011-03-07",
            "weekly.2011-02-24",
            "weekly.2011-02-15",
            "weekly.2011-02-01.1",
            "weekly.2011-02-01",
            "weekly.2011-01-20",
            "weekly.2011-01-19",
            "weekly.2011-01-12",
            "weekly.2011-01-06",
            "weekly.2010-12-22",
            "weekly.2010-12-15.1",
            "weekly.2010-12-15",
            "weekly.2010-12-08",
            "weekly.2010-12-02",
            "weekly.2010-11-23",
            "weekly.2010-11-10",
            "weekly.2010-11-02",
            "weekly.2010-10-27",
            "weekly.2010-10-20",
            "weekly.2010-10-13.1",
            "weekly.2010-10-13",
            "weekly.2010-09-29",
            "weekly.2010-09-22",
            "weekly.2010-09-15",
            "weekly.2010-09-06",
            "weekly.2010-08-25",
            "weekly.2010-08-11",
            "weekly.2010-08-04",
            "weekly.2010-07-29",
            "weekly.2010-07-14",
            "weekly.2010-07-01",
            "weekly.2010-06-21",
            "weekly.2010-06-09",
            "weekly.2010-05-27",
            "weekly.2010-05-04",
            "weekly.2010-04-27",
            "weekly.2010-04-13",
            "weekly.2010-03-30",
            "weekly.2010-03-22",
            "weekly.2010-03-15",
            "weekly.2010-03-04",
            "weekly.2010-02-23",
            "weekly.2010-02-17",
            "weekly.2010-02-04",
            "weekly.2010-01-27",
            "weekly.2010-01-13",
            "weekly.2010-01-05",
            "weekly.2009-12-22",
            "weekly.2009-12-09",
            "weekly.2009-12-07",
            "weekly.2009-11-17",
            "weekly.2009-11-12",
            "weekly.2009-11-10.1",
            "weekly.2009-11-10",
            "weekly.2009-11-06"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-61729.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:22.745176917Z",
      "provider": "osv",
      "references": [
        "https://go.dev/cl/725920",
        "https://go.dev/issue/76445",
        "https://groups.google.com/g/golang-announce/c/8FJoBkPddm4",
        "https://pkg.go.dev",
        "https://pkg.go.dev/vuln/GO-2025-4155",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61729.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-61729"
      ],
      "provider_metadata": {
        "cna_assigner": "Go",
        "unresolved_ranges": [
          {
            "extracted_events": [
              {
                "range": [
                  {
                    "fixed": "1.24.11"
                  },
                  {
                    "introduced": "1.25.0"
                  },
                  {
                    "fixed": "1.25.5"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandardRange"
              }
            ]
          }
        ],
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61729.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-61729",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 489236,
  "published_at": "2025-12-02T18:54:10.166+00:00"
}