CVE-2025-61723: 
cAdvisor Analyse et atténuation des vulnérabilités

CVE-2025-61723 is a vulnerability discovered in the encoding/pem package of the Go programming language, disclosed on October 29, 2025. The vulnerability affects programs that parse untrusted PEM inputs, where the processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input (Golang Announce, Ubuntu Security).

The vulnerability stems from the design of the PEM parsing function, which exhibits quadratic complexity when processing certain invalid inputs. The issue has been assigned a CVSS 3.1 base score of 7.5 (High), with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vulnerability primarily affects the availability of systems processing untrusted PEM inputs (Ubuntu Security).

The primary impact of this vulnerability is on system availability. When processing maliciously crafted invalid PEM inputs, affected systems may experience excessive CPU consumption, potentially leading to denial of service conditions. The vulnerability specifically affects programs that parse untrusted PEM inputs, with no direct impact on confidentiality or integrity (Rapid7 DB).

The vulnerability has been fixed in Go versions 1.25.2 and 1.24.8. Users are advised to upgrade to these versions or later to address the issue. The fix was implemented through commits 90f72bd5001d0278949fab0b7a40f7d8c712979b (go1.25.2) and 74d4d836b91318a8764b94bc2b4b66ff599eb5f2 (go1.24.8) (Golang Announce).