---
id: CVE-2025-61728
aliases:
  - GO-2026-4342
  - BIT-golang-2025-61728
title: Excessive CPU consumption when building archive index in archive/zip
summary: Excessive CPU consumption when building archive index in archive/zip
severity: none
vendor: stdlib
product: stdlib
ecosystem: go
affected:
  - 'stdlib >= 1.25.0, < 1.25.6'
patched:
  - stdlib 1.25.6
published: '2026-01-28'
updated: '2026-07-23'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2026-4342'
references:
  - url: 'https://go.dev/cl/736713'
  - url: 'https://go.dev/issue/77102'
  - url: 'https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc'
tags:
  - osv
  - go
epss: 0.00683
epssPercentile: 0.50393
ingestedAt: '2026-07-23T19:05:54.055Z'
---

## Overview

archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.

## Affected packages

- `stdlib >= 1.25.0, < 1.25.6`

## Remediation

Upgrade to a patched release:

- `stdlib 1.25.6`