Go Language Releases Security Patches for Multiple DoS and Memory Exhaustion Flaws
Take action: There are multiple flaws in Go language that may affect your applications. Check the advisory and update your Go toolchain to version 1.25.6 or 1.24.12. Then rebuild all production binaries using the updated versions.
Learn More
The Go programming language team released security updates for versions 1.25.6 and 1.24.12 to address six vulnerabilities. These flaws allow attackers to trigger denial-of-service (DoS) states, leak sensitive data, or execute arbitrary code.
Vulnerabilities causing DoS/ system crashes through resource exhaustion:
- CVE-2025-61728 (CVSS score 9.1) - Super-linear file name indexing in ZIP archives causing computational exhaustion. A flaw in the archive/zip package uses a slow indexing algorithm that attackers can trigger with specially crafted ZIP files.
- CVE-2025-61726 (CVSS score 9.1) - Excessive memory allocation in net/http during form parsing. Affects the HTTP package when parsing URL-encoded forms. Attackers can send forms with a high number of keys to force the server to allocate excessive memory, leading to a crash.
Data leak flaws:
- CVE-2025-68121 (CVSS score 9.1) - Improper session ticket key handling in TLS configuration cloning. Leaks session ticket keys when cloning configurations, which could allow attackers to resume sessions without proper authorization.
- CVE-2025-61730 (CVSS score 9.1) - Handshake message processing at incorrect encryption levels. Allows handshake messages to be processed at incorrect encryption levels, potentially exposing data to attackers on the same local network.
Arbitrary code execution (RCE) on developer machines or build servers:
- CVE-2025-61731 (CVSS score 9.1) - Bypass of compiler flag sanitization in CgoPkgConfig. The Cgo tool fails to sanitize compiler flags, allowing attackers to run the pkg-config tool with malicious parameters.
- CVE-2025-68119 (CVSS score 9.1) - Arbitrary code execution via malicious VCS version strings in the Go toolchain. The Go toolchain’s integration with version control systems like Git and Mercurial contained a flaw. Attackers could use malicious version strings or non-standard sources to execute commands when a developer downloads or builds a module.
Organizations should download the latest binaries from the official Go download page. Because these flaws exist in the standard library, simply updating the toolchain is not enough; all existing Go applications must be recompiled using the patched versions to ensure they are no longer vulnerable to these exploits.
