CVE-2025-61723: Go Standard Library 'encoding/pem' Vulnerability Leading to Quadratic Complexity in Input Parsing
Summary
CVE-2025-61723: Quadratic complexity when parsing some invalid inputs in encoding/pem. Affects stdlib across 2 version ranges.
< 1.24.8
>= 1.25.0, < 1.25.2
Fixed in 1.24.8 or 1.25.2, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2025-61723 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Go standard library is a collection of packages that provide essential functionality for Go applications. Among these packages, 'encoding/pem' is responsible for encoding and decoding PEM (Privacy-Enhanced Mail) data, which is commonly used for cryptographic keys and certificates. This package is critical for applications that handle secure communications, making its reliability paramount. However, it is susceptible to a vulnerability that affects its performance when parsing certain invalid inputs.
Vulnerability Detail
The vulnerability arises from the way the 'encoding/pem' package processes invalid inputs. Specifically, the parsing time scales non-linearly with the size of the input, leading to quadratic complexity. This can result in significant performance degradation, particularly when handling untrusted PEM inputs. Attackers could exploit this vulnerability to cause denial-of-service conditions by providing specially crafted invalid inputs, leading to excessive resource consumption and potentially crashing the application.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.24.81.24.8go get stdlib@v1.24.8 -
>= 1.25.0, < 1.25.21.25.2go get stdlib@v1.25.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can implement input validation to filter out invalid PEM inputs before passing them to the 'encoding/pem' package. This can help mitigate the risk of performance issues. For example, you could check the input format and length before attempting to decode it.
Conclusion
The CVE-2025-61723 vulnerability in the Go standard library's 'encoding/pem' package poses a significant risk due to its quadratic complexity in parsing invalid inputs. It is crucial for developers to update to the patched versions to mitigate this risk and ensure the reliability of their applications.
See every vulnerability recorded for stdlib →
FAQ
CVE-2025-61723 is a vulnerability in the Go standard library's 'encoding/pem' package that leads to quadratic complexity when parsing certain invalid inputs.
This vulnerability can cause significant performance issues, including denial-of-service conditions, when handling untrusted PEM inputs.
The vulnerability affects versions prior to 1.24.8 and 1.25.2. It is recommended to upgrade to these patched versions.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, implement input validation to filter out invalid PEM inputs as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
