CVE-2025-61724: Excessive CPU Consumption in net/textproto Package's Reader.ReadResponse Function
Summary
CVE-2025-61724: Excessive CPU consumption in Reader.ReadResponse in net/textproto. Affects stdlib across 2 version ranges.
< 1.24.8
>= 1.25.0, < 1.25.2
Fixed in 1.24.8 or 1.25.2, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2025-61724 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net/textproto package in Go's standard library is responsible for handling text-based protocols. It provides functionalities to read and write protocol messages, making it essential for applications that communicate over text-based protocols like HTTP. The package is widely used due to its efficiency and ease of integration into Go applications. However, it is susceptible to performance issues when handling large responses, particularly due to the way the Reader.ReadResponse function constructs response strings.
Vulnerability Detail
The vulnerability arises from the Reader.ReadResponse function, which concatenates response lines using repeated string concatenation. When processing a response with a large number of lines, this method can lead to excessive CPU consumption, potentially degrading application performance or causing denial of service. The issue is particularly critical for applications that rely on processing large text responses, as it can lead to unresponsive behavior or crashes.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.24.81.24.8go get stdlib@v1.24.8 -
>= 1.25.0, < 1.25.21.25.2go get stdlib@v1.25.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider limiting the size of the responses your application processes or implementing a timeout mechanism to prevent excessive CPU usage. Additionally, you can manually handle the response parsing to avoid using the vulnerable Reader.ReadResponse function until you can update to a patched version.
Conclusion
CVE-2025-61724 presents a significant risk for applications using the net/textproto package in Go's standard library, particularly when handling large text responses. It is crucial to update to the patched versions to mitigate this vulnerability and ensure optimal application performance.
See every vulnerability recorded for stdlib →
FAQ
CVE-2025-61724 is a vulnerability in the net/textproto package of Go's standard library that causes excessive CPU consumption when processing large response strings.
Applications that use the Reader.ReadResponse function to handle large text responses may experience performance degradation or crashes due to high CPU usage.
The vulnerability affects versions prior to 1.24.8 and 1.25.0, specifically versions 1.23.3 and earlier.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package right away, implement a workaround by limiting response sizes or using a timeout mechanism to manage CPU usage.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
