CVE-2025-61728
📋 TL;DR
This vulnerability in Go's archive/zip package uses an inefficient file name indexing algorithm that can be exploited via specially crafted ZIP archives. Attackers can cause denial of service by forcing excessive CPU consumption when processing malicious archives. This affects any Go application that processes ZIP files from untrusted sources.
💻 Affected Systems
- Go programming language
- Applications using Go's archive/zip package
📦 What is this software?
Go by Golang
Go by Golang
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to CPU exhaustion, potentially affecting multiple services on the same host through resource starvation.
Likely Case
Degraded performance or temporary unavailability of services processing ZIP files, requiring manual intervention to restore service.
If Mitigated
Minimal impact with proper input validation and resource limits in place, though some performance degradation may still occur.
🎯 Exploit Status
Proof of concept available in Go issue tracker. Exploitation requires only file upload capability, no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Go 1.24.0 or Go 1.23.5
Vendor Advisory: https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc
Restart Required: Yes
Instructions:
1. Update Go installation to version 1.24.0 or 1.23.5. 2. Recompile all affected applications. 3. Restart services using the updated binaries.
🔧 Temporary Workarounds
Limit ZIP file processing
allImplement size limits and timeout controls for ZIP file processing
Input validation
allValidate ZIP files before processing, reject archives with excessive file counts
🧯 If You Can't Patch
- Implement strict file size limits for ZIP uploads (e.g., <10MB)
- Use rate limiting and monitoring for ZIP processing endpoints
🔍 How to Verify
Check if Vulnerable:
Check Go version with 'go version'. If version is before 1.24.0 and not 1.23.5, system is vulnerable.Check Version:
go versionVerify Fix Applied:
Verify Go version is 1.24.0 or 1.23.5, then test with known malicious ZIP sample to ensure no CPU exhaustion.📡 Detection & Monitoring
Log Indicators:
- High CPU usage spikes during file processing
- ZIP processing timeouts
- Application crashes during archive extraction
Network Indicators:
- Large ZIP file uploads followed by service degradation
- Repeated ZIP upload attempts
SIEM Query:
source="application.logs" AND ("zip" OR "archive") AND ("timeout" OR "high cpu" OR "denial of service")