CVE-2025-61728: 
Go vulnerability analysis and mitigation

CVE-2025-61728 is a denial-of-service vulnerability in Go's archive/zip standard library package caused by a super-linear file name indexing algorithm. The algorithm is triggered the first time a file within a ZIP archive is opened, allowing a maliciously crafted archive to cause excessive CPU consumption and application unavailability. It affects Go versions prior to 1.24.12 (in the 1.24.x branch) and prior to 1.25.6 (in the 1.25.x branch). The vulnerability was reported by Jakub Ciolek and publicly disclosed on January 28, 2026, with a CVSS v3.1 base score of 6.5 (Medium) (Openwall oss-sec, Go Vuln DB).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). The archive/zip package used a super-linear — effectively quadratic — algorithm to build a file name index when the first file in an archive is accessed. An attacker can craft a ZIP archive with a large number of deeply nested or specially structured file names that cause the indexing routine to perform an excessive number of string operations, exhausting CPU resources. The fix, available in Go commit bb7c0c7, replaces the iterative path.Dir() loop with a more efficient strings.LastIndex-based approach that avoids repeated string allocation and canonicalization (Go Issue 77102, Go CL 736713, Openwall oss-sec). Exploitation requires user interaction — specifically, an application or user must open or process the malicious ZIP file.

Successful exploitation results in a high availability impact: the affected Go application or service becomes unresponsive or crashes due to CPU exhaustion while processing the malicious archive. There is no confidentiality or integrity impact — the vulnerability cannot be used to access or modify data. Any application written in Go that uses the archive/zip package to open user-supplied or network-delivered ZIP files is potentially affected, including a broad range of downstream products such as IBM Instana, IBM API Connect, IBM Guardium Data Protection, Grafana, Podman, CoreDNS, and others (Go Vuln DB, IBM Advisory).

A proof-of-concept reference exists on the Openwall oss-security mailing list, though no weaponized exploit kit or active in-the-wild exploitation has been reported (Openwall oss-sec). The EPSS score is very low at approximately 0.008%, reflecting limited exploitation probability in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified.

1. Craft a malicious ZIP archive: Create a ZIP file containing a large number of entries with deeply nested directory paths (e.g., a/b/c/d/.../file.txt repeated thousands of times) designed to maximize the number of iterations in the super-linear indexing algorithm.
2. Deliver the archive to the target: Host the malicious ZIP file on a web server, attach it to an email, or otherwise deliver it to a target application or user that processes ZIP files using Go's archive/zip package.
3. Trigger archive processing: Induce the target application to open the ZIP archive — for example, by uploading it to a file-processing service, submitting it via an API endpoint, or having a user open it with a Go-based tool.
4. Cause denial of service: When the application calls any function that opens a file within the archive for the first time, the super-linear indexing algorithm executes, consuming excessive CPU and causing the application to hang or become unresponsive (Go Issue 77102, Openwall oss-sec).

• Process: Go application processes exhibiting sustained near-100% CPU utilization while handling ZIP file operations, with no corresponding increase in I/O or network activity.
• Logs: Application logs showing stalled or timed-out requests associated with ZIP file upload or processing endpoints; goroutine dumps showing threads blocked in archive/zip indexing routines.
• Network: Repeated submission of unusually large or structurally complex ZIP files (many entries, deeply nested paths) to file-processing endpoints from the same source IP.
• File System: Presence of ZIP files with an abnormally high number of directory entries or deeply nested path structures in upload or temporary directories.

Upgrade Go to version 1.24.12 or later (for the 1.24.x branch) or 1.25.6 or later (for the 1.25.x branch); these releases contain the fix (Go CL 736713, Go Vuln DB). Downstream products incorporating the vulnerable Go runtime should also be updated — IBM, Red Hat, SUSE, Oracle, Amazon Linux, and others have issued advisories and updated packages. As a temporary workaround where upgrading is not immediately possible, restrict or sandbox applications that process untrusted ZIP archives, and implement file size and entry-count limits on ZIP uploads at the application or network layer to reduce exposure.

The Go team announced the fix as part of the Go 1.25.6 and 1.24.12 release via the golang-announce mailing list (golang-announce). Security news outlets including CyberSecurityNews, GBHackers, and CyberPress covered the release, noting the DoS and memory exhaustion risks addressed in the update. The vulnerability appeared in Reddit's CVEWatch trending CVE lists shortly after disclosure. Community discussion on Openwall oss-security included technical commentary on the algorithmic root cause and the nature of the fix, with one contributor noting the broader implication that Go's standard library path utilities lacked sufficient efficiency guarantees to prevent such issues (Openwall oss-sec).