Excessive CPU Consumption in Go's ParseAddress Function
CVE-2025-61725

Currently unrated

Key Information:

Vendor

Go Standard Library

Status
Net/mail
Vendor
CVE Published:
29 October 2025

What is CVE-2025-61725?

The vulnerability in Go's ParseAddress function arises from its method of constructing domain-literal address components via repeated string concatenation. This inefficiency leads to significant CPU overutilization when dealing with large domain-literal inputs, which can impair performance and responsiveness of applications utilizing this function.

Affected Version(s)

net/mail 0 < 1.24.8

net/mail 1.25.0 < 1.25.2

References

https://go.dev/cl/709860
https://go.dev/issue/75680
https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Philippe Antoine (Catena cyber)
JSON
.
CVE-2025-61725 : Excessive CPU Consumption in Go's ParseAddress Function