Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.
References
| Link | Resource |
|---|---|
| https://go.dev/cl/725920 | Patch |
| https://go.dev/issue/76445 | Issue Tracking Patch |
| https://groups.google.com/g/golang-announce/c/8FJoBkPddm4 | Mailing List Release Notes |
| https://pkg.go.dev/vuln/GO-2025-4155 | Vendor Advisory |
Configurations
History
19 Dec 2025, 18:25
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | |
| CWE | CWE-295 | |
| First Time |
Golang go
Golang |
|
| References | () https://go.dev/cl/725920 - Patch | |
| References | () https://go.dev/issue/76445 - Issue Tracking, Patch | |
| References | () https://groups.google.com/g/golang-announce/c/8FJoBkPddm4 - Mailing List, Release Notes | |
| References | () https://pkg.go.dev/vuln/GO-2025-4155 - Vendor Advisory |
02 Dec 2025, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
02 Dec 2025, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-02 19:15
Updated : 2025-12-19 18:25
NVD link : CVE-2025-61729
Mitre link : CVE-2025-61729
CVE.ORG link : CVE-2025-61729
JSON object : View
Products Affected
golang
- go
CWE
CWE-295
Improper Certificate Validation