{"id":"CVE-2025-61728","aliases":["GO-2026-4342","BIT-golang-2025-61728"],"title":"Excessive CPU consumption when building archive index in archive/zip","summary":"Excessive CPU consumption when building archive index in archive/zip","severity":"none","vendor":"stdlib","product":"stdlib","ecosystem":"go","affected":["stdlib >= 1.25.0, < 1.25.6"],"patched":["stdlib 1.25.6"],"published":"2026-01-28","updated":"2026-07-23","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GO-2026-4342","references":[{"url":"https://go.dev/cl/736713"},{"url":"https://go.dev/issue/77102"},{"url":"https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"}],"tags":["osv","go"],"epss":0.00683,"epssPercentile":0.50682,"ingestedAt":"2026-07-23T19:05:54.055Z","slug":"CVE-2025-61728","body":"## Overview\n\narchive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.\n\n## Affected packages\n\n- `stdlib >= 1.25.0, < 1.25.6`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `stdlib 1.25.6`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}