Skip to content

Commit e78910e

Browse files
nicholashusingopherbot
nicholashusin
authored and
gopherbot
committed
data/reports: add GO-2025-4155
 - data/reports/GO-2025-4155.yaml Fixes #4155 Change-Id: Iea03d58cccc05eb2df016ef505c88d3d8783bd01 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/725980 LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Neal Patel <[email protected]> Auto-Submit: Nicholas Husin <[email protected]> Reviewed-by: Nicholas Husin <[email protected]>
1 parent 3d89fef commit e78910e

File tree

3 files changed

+187
-0
lines changed

3 files changed

+187
-0
lines changed

‎data/cve/v5/GO-2025-4155.json‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
{
2+
"dataType": "CVE_RECORD",
3+
"dataVersion": "5.0",
4+
"cveMetadata": {
5+
"cveId": "CVE-2025-61729"
6+
},
7+
"containers": {
8+
"cna": {
9+
"providerMetadata": {
10+
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc"
11+
},
12+
"title": "Excessive resource consumption when printing error string for host certificate validation in crypto/x509",
13+
"descriptions": [
14+
{
15+
"lang": "en",
16+
"value": "Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption."
17+
}
18+
],
19+
"affected": [
20+
{
21+
"vendor": "Go standard library",
22+
"product": "crypto/x509",
23+
"collectionURL": "https://pkg.go.dev",
24+
"packageName": "crypto/x509",
25+
"versions": [
26+
{
27+
"version": "0",
28+
"lessThan": "1.24.11",
29+
"status": "affected",
30+
"versionType": "semver"
31+
},
32+
{
33+
"version": "1.25.0",
34+
"lessThan": "1.25.5",
35+
"status": "affected",
36+
"versionType": "semver"
37+
}
38+
],
39+
"programRoutines": [
40+
{
41+
"name": "HostnameError.Error"
42+
}
43+
],
44+
"defaultStatus": "unaffected"
45+
}
46+
],
47+
"problemTypes": [
48+
{
49+
"descriptions": [
50+
{
51+
"lang": "en",
52+
"description": "CWE-400: Uncontrolled Resource Consumption"
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"url": "https://go.dev/cl/725920"
60+
},
61+
{
62+
"url": "https://go.dev/issue/76445"
63+
},
64+
{
65+
"url": "https://groups.google.com/g/golang-announce/c/8FJoBkPddm4"
66+
},
67+
{
68+
"url": "https://pkg.go.dev/vuln/GO-2025-4155"
69+
}
70+
],
71+
"credits": [
72+
{
73+
"lang": "en",
74+
"value": "Philippe Antoine (Catena cyber)"
75+
}
76+
]
77+
}
78+
}
79+
}

‎data/osv/GO-2025-4155.json‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-4155",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-61729",
8+
"CVE-2025-61729"
9+
],
10+
"summary": "Excessive resource consumption when printing error string for host certificate validation in crypto/x509",
11+
"details": "Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "stdlib",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "1.24.11"
27+
},
28+
{
29+
"introduced": "1.25.0"
30+
},
31+
{
32+
"fixed": "1.25.5"
33+
}
34+
]
35+
}
36+
],
37+
"ecosystem_specific": {
38+
"imports": [
39+
{
40+
"path": "crypto/x509",
41+
"symbols": [
42+
"HostnameError.Error"
43+
]
44+
}
45+
]
46+
}
47+
}
48+
],
49+
"references": [
50+
{
51+
"type": "FIX",
52+
"url": "https://go.dev/cl/725920"
53+
},
54+
{
55+
"type": "REPORT",
56+
"url": "https://go.dev/issue/76445"
57+
},
58+
{
59+
"type": "WEB",
60+
"url": "https://groups.google.com/g/golang-announce/c/8FJoBkPddm4"
61+
}
62+
],
63+
"credits": [
64+
{
65+
"name": "Philippe Antoine (Catena cyber)"
66+
}
67+
],
68+
"database_specific": {
69+
"url": "https://pkg.go.dev/vuln/GO-2025-4155",
70+
"review_status": "REVIEWED"
71+
}
72+
}

‎data/reports/GO-2025-4155.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
id: GO-2025-4155
2+
modules:
3+
- module: std
4+
versions:
5+
- fixed: 1.24.11
6+
- introduced: 1.25.0
7+
- fixed: 1.25.5
8+
vulnerable_at: 1.25.4
9+
packages:
10+
- package: crypto/x509
11+
symbols:
12+
- HostnameError.Error
13+
summary: |-
14+
Excessive resource consumption when printing error string for host certificate
15+
validation in crypto/x509
16+
description: |-
17+
Within HostnameError.Error(), when constructing an error string, there is no
18+
limit to the number of hosts that will be printed out. Furthermore, the error
19+
string is constructed by repeated string concatenation, leading to quadratic
20+
runtime. Therefore, a certificate provided by a malicious actor can result in
21+
excessive resource consumption.
22+
cves:
23+
- CVE-2025-61729
24+
credits:
25+
- Philippe Antoine (Catena cyber)
26+
references:
27+
- fix: https://go.dev/cl/725920
28+
- report: https://go.dev/issue/76445
29+
- web: https://groups.google.com/g/golang-announce/c/8FJoBkPddm4
30+
cve_metadata:
31+
id: CVE-2025-61729
32+
cwe: 'CWE-400: Uncontrolled Resource Consumption'
33+
source:
34+
id: go-security-team
35+
created: 2025-12-02T12:24:17.281378783-05:00
36+
review_status: REVIEWED

0 commit comments

Comments
 (0)