Denial of Service Vulnerability in Go's ZIP Archive Handling
CVE-2025-61728

6.5MEDIUM

Key Information:

Vendor: Go Standard Library
Status: Archive/zip
Vendor: CVE Published:; 28 January 2026

🔔 Create Go Standard Library Vulnerability Alert

What is CVE-2025-61728?

The Go archive/zip package is vulnerable to a denial of service (DoS) attack caused by a super-linear file name indexing algorithm triggered when opening ZIP files. If a user attempts to access a maliciously constructed ZIP archive, the indexing algorithm may consume excessive resources, leading to potential service interruptions. It is crucial for users of the affected package to apply updates and monitor for any patches to mitigate this risk.

Affected Version(s)

archive/zip 0 < 1.24.12

archive/zip 1.25.0 < 1.25.6

References

https://go.dev/cl/736713

https://go.dev/issue/77102

https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc

CVSS V3.1

Score:

6.5

Severity:

MEDIUM

Confidentiality:

None

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jan 28, 2026
Vulnerability Reserved
Sep 30, 2025

Credit

Jakub Ciolek

CVE-2025-61728 Data

JSON