Denial of Service Vulnerability in Go's ZIP Archive Handling
CVE-2025-61728

6.5MEDIUM

Key Information:

Vendor

Go Standard Library

Status
Archive/zip
Vendor
CVE Published:
28 January 2026

What is CVE-2025-61728?

The Go archive/zip package is vulnerable to a denial of service (DoS) attack caused by a super-linear file name indexing algorithm triggered when opening ZIP files. If a user attempts to access a maliciously constructed ZIP archive, the indexing algorithm may consume excessive resources, leading to potential service interruptions. It is crucial for users of the affected package to apply updates and monitor for any patches to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

archive/zip 0 < 1.24.12

archive/zip 1.25.0 < 1.25.6

References

https://go.dev/cl/736713
https://go.dev/issue/77102
https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jakub Ciolek
JSON
.