CVE-2025-61726: 
Go vulnerability analysis and mitigation

CVE-2025-61726 is a denial-of-service vulnerability in Go's net/url package caused by unbounded query parameter parsing. The net/http.Request.ParseForm method can parse large URL-encoded forms without enforcing a limit on the number of unique query parameters, leading to excessive memory consumption. It affects Go versions prior to 1.24.12 and versions 1.25.0 through 1.25.5. The vulnerability was published on January 28, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (Go Advisory, IBM Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). The net/url package imposes no cap on the number of query parameters parsed from a URL query string. While HTTP request header size limits typically constrain individual URL lengths, the net/http.Request.ParseForm method can independently parse large URL-encoded request bodies, bypassing this constraint. An unauthenticated remote attacker can send an HTTP request containing a URL-encoded form body with a very large number of unique query parameters, causing the Go application to allocate unbounded memory during parsing. No authentication or user interaction is required, and attack complexity is low (Go Issue, Go CL, Go Advisory).

Successful exploitation results in excessive memory consumption on the affected server, potentially causing the application to become unresponsive or crash, constituting a denial-of-service (DoS) condition. There is no confidentiality or integrity impact — only availability is affected. Any Go application that calls net/http.Request.ParseForm (or methods that invoke it) on untrusted HTTP input is at risk, including web servers, API gateways, and microservices built with Go. Downstream products incorporating vulnerable Go versions are also affected, including IBM Observability with Instana, IBM API Connect, IBM Db2 on Cloud Pak for Data, IBM Guardium Data Protection, and others (IBM Advisory, Go Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.008% (0.000080), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Despite the low exploitation probability, the attack requires no authentication, no user interaction, and is network-accessible, making it straightforward to attempt against exposed Go HTTP services.

1. Reconnaissance: Identify internet-facing services built with a vulnerable version of Go (prior to 1.24.12 or 1.25.0–1.25.5) that expose HTTP endpoints accepting form data or query parameters.
2. Craft malicious request: Construct an HTTP POST request with a Content-Type: application/x-www-form-urlencoded body containing a very large number of unique key-value pairs (e.g., a1=v&a2=v&a3=v... with thousands of unique keys).
3. Send request: Transmit the crafted request to any endpoint on the target server that triggers ParseForm or related methods (e.g., FormValue, PostFormValue, or any handler that reads form data).
4. Trigger memory exhaustion: The server's Go runtime allocates memory for each unique query parameter without limit, causing memory to spike rapidly.
5. Achieve DoS: Repeated or sustained requests exhaust available memory, causing the server process to slow significantly, trigger OOM conditions, or crash, denying service to legitimate users (Go Issue, Go CL).

• Network: Unusually high volume of HTTP POST requests with large Content-Type: application/x-www-form-urlencoded bodies targeting form-processing endpoints; requests with abnormally large body sizes containing many unique parameter keys.
• Logs: Application or web server access logs showing repeated large POST requests from the same or rotating source IPs; HTTP 500 or 503 responses following large form submissions indicating server-side memory pressure.
• Process/System: Sudden spikes in memory usage by the Go application process (observable via top, htop, or monitoring tools); OOM killer events in system logs (/var/log/syslog or dmesg) referencing the Go service process; application crashes or restarts correlating with large inbound requests.

Update Go to version 1.24.12 or later (for installations on the 1.24.x branch) or 1.25.6 or later (for installations on the 1.25.x branch), which introduce a limit on the number of query parameters parsed by ParseForm (Go CL, Go Advisory). For systems that cannot be immediately patched, implement the following interim mitigations:

• Deploy a reverse proxy or WAF rule to reject requests with excessively large bodies or an abnormally high number of query parameters.
• Apply rate limiting at the network or application layer to reduce the impact of repeated large-form requests.
• Monitor application memory consumption and set process memory limits to contain the blast radius of exploitation attempts.

Downstream product users should apply vendor-specific patches from IBM, Red Hat, SUSE, and other affected vendors as they become available (IBM Advisory, Red Hat).

The Go security team disclosed the vulnerability via the golang-announce mailing list alongside the Go 1.24.12 and 1.25.6 releases (golang-announce). Security news outlets including CyberSecurityNews, GBHackers, and CyberPress covered the releases, noting the memory exhaustion risk for Go-based services. The vulnerability appeared in community CVE tracking threads on Reddit (r/CVEWatch) and was discussed on Mastodon and Bluesky by security researchers. IBM, Red Hat, SUSE, Oracle, and other major vendors issued advisories and patches for their products incorporating affected Go versions, reflecting broad industry awareness of the supply-chain impact.