CVE-2025-61728None▾ SunlitExcessive CPU consumption when building archive index in archive/zip
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.6%
0.6% → 0.7%
archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.
stdlib >= 1.25.0, < 1.25.6Upgrade to a patched release:
stdlib 1.25.6Connected by shared product, vendor, weakness, or advisory.
CVE-2026-56860High· 7.5Avoid quadratic complexity in resolvePath in net/url
CVE-2026-56858High· 8.1Fix Javascript regexp context tracking in html/template
CVE-2026-56862High· 7.5Limit handshake messages we are willing to accept post-handshake in crypto/tls
CVE-2026-56859High· 7.5Add recursion depth guard during decode in encoding/xml
CVE-2026-33818High· 7.5Enforce maximum recursion depth in encoding/asn1
CVE-2024-34158NoneStack exhaustion in Parse in go/build/constraint