Search results

net/textproto: excessive CPU consumption in Reader.ReadResponse (CVE-2025-61724) [1.24 backport]

CherryPickApprovedUsed during the release process for point releasesUsed during the release process for point releases

release-blocker

Security

Status: Closed (completed).

#75717 In golang/go;

· by gopherbot was closed on Oct 7, 2025

·  

Go1.24.8

crypto/x509: quadratic complexity when checking name constraints (CVE-2025-58187) [1.24 backport]

CherryPickApprovedUsed during the release process for point releasesUsed during the release process for point releases

release-blocker

Security

Status: Closed (completed).

#75714 In golang/go;

· by gopherbot was closed on Oct 7, 2025

·  

Go1.24.8

net/url: insufficient validation of bracketed IPv6 hostnames (CVE-2025-47912) [1.24 backport]

CherryPickApprovedUsed during the release process for point releasesUsed during the release process for point releases

release-blocker

Security

Status: Closed (completed).

#75712 In golang/go;

· by gopherbot was closed on Oct 7, 2025

·  

Go1.24.8

archive/tar: unbounded allocation when parsing GNU sparse map (CVE-2025-58183) [1.24 backport]

CherryPickApprovedUsed during the release process for point releasesUsed during the release process for point releases

release-blocker

Security

Status: Closed (completed).

#75710 In golang/go;

· by gopherbot was closed on Oct 7, 2025

·  

Go1.24.8

encoding/pem: quadratic complexity when parsing some invalid inputs (CVE-2025-61723) [1.24 backport]

CherryPickApprovedUsed during the release process for point releasesUsed during the release process for point releases

release-blocker

Security

Status: Closed (completed).

#75708 In golang/go;

· by gopherbot was closed on Oct 7, 2025

·  

Go1.24.8

net/http: lack of limit when parsing cookies can cause memory exhaustion (CVE-2025-58186) [1.24 backport]

CherryPickApprovedUsed during the release process for point releasesUsed during the release process for point releases

release-blocker

Security

Status: Closed (completed).

#75706 In golang/go;

· by gopherbot was closed on Oct 7, 2025

·  

Go1.24.8

encoding/asn1: pre-allocating memory when parsing DER payload can cause memory exhaustion (CVE-2025-58185) [1.24 backport]

CherryPickApprovedUsed during the release process for point releasesUsed during the release process for point releases

release-blocker

Security

Status: Closed (completed).

#75704 In golang/go;

· by gopherbot was closed on Oct 7, 2025

·  

Go1.24.8

crypto/x509: panic when validating certificates with DSA public keys (CVE-2025-58188) [1.24 backport]

CherryPickApprovedUsed during the release process for point releasesUsed during the release process for point releases

release-blocker

Security

Status: Closed (completed).

#75702 In golang/go;

· by gopherbot was closed on Oct 7, 2025

·  

Go1.24.8

net/mail: excessive CPU consumption in ParseAddress (CVE-2025-61725) [1.24 backport]

CherryPickApprovedUsed during the release process for point releasesUsed during the release process for point releases

release-blocker

Security

Status: Closed (completed).

#75700 In golang/go;

· by gopherbot was closed on Oct 7, 2025

·  

Go1.24.8