CVE-2025-61724: 
cAdvisor vulnerability analysis and mitigation

The vulnerability CVE-2025-61724 affects the Go programming language's net/textproto package. Discovered and disclosed on October 29, 2025, this vulnerability involves the Reader.ReadResponse function which constructs a response string through repeated string concatenation of lines. The issue affects multiple versions of Go, including versions before 1.24.8 and from 1.25.0 before 1.25.2 (Go Project).

The vulnerability stems from a design flaw in the Reader.ReadResponse function where it performs repeated string concatenation of lines. When processing responses containing a large number of lines, this implementation can result in excessive CPU consumption. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (Ubuntu, NVD).

The primary impact of this vulnerability is potential denial of service through excessive CPU consumption when processing responses with a large number of lines. This affects applications that process untrusted response data using the affected function (Go Project).

The vulnerability has been fixed in Go versions 1.24.8 and 1.25.2. Users are advised to upgrade to these patched versions. The fixes are available through the official Go website and can be obtained by updating to the release with git checkout go1.25.2 for version 1.25.2 or the corresponding version for 1.24.8 (Go Project).