CVE-2025-61725: Excessive CPU Consumption in net/mail Package's ParseAddress Function
Summary
CVE-2025-61725: Excessive CPU consumption in ParseAddress in net/mail. Affects stdlib across 2 version ranges.
< 1.24.8
>= 1.25.0, < 1.25.2
Fixed in 1.24.8 or 1.25.2, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2025-61725 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The net/mail package in Go is responsible for parsing email addresses and handling mail-related functionalities. It provides essential tools for developers to work with email addresses in a structured manner. However, the ParseAddress function within this package has been identified to have a vulnerability that can lead to excessive CPU consumption when processing large domain-literal components.
Vulnerability Detail
The vulnerability arises from the ParseAddress function, which constructs domain-literal address components through repeated string concatenation. This inefficient method can lead to significant CPU resource consumption when parsing large domain-literal components, potentially causing performance degradation in applications that rely on this functionality. If exploited, this could lead to denial of service conditions, affecting the overall responsiveness of the application.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.24.81.24.8go get stdlib@v1.24.8 -
>= 1.25.0, < 1.25.21.25.2go get stdlib@v1.25.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can limit the size of the domain-literal components being parsed or implement their own parsing logic that avoids the use of the vulnerable ParseAddress function until an update can be applied.
Conclusion
In summary, CVE-2025-61725 represents a significant vulnerability in the net/mail package of Go, leading to excessive CPU consumption during the parsing of large domain-literal components. It is crucial for developers to update their packages to the patched versions and consider workarounds to maintain application performance.
See every vulnerability recorded for stdlib →
FAQ
CVE-2025-61725 is a vulnerability in the net/mail package of Go that can lead to excessive CPU consumption when parsing large domain-literal address components.
This vulnerability can cause performance issues, leading to high CPU usage and potentially resulting in denial of service conditions for applications that utilize the affected functions.
The vulnerability affects versions prior to 1.24.8 and between 1.25.0 and 1.25.2 of the net/mail package.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By using the Vulert playground, you can check if your application is affected by this vulnerability without any signup.
You should update your net/mail package to version 1.24.8 or later, or 1.25.2 or later. Additionally, consider implementing temporary workarounds to limit the size of domain-literal components being parsed.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
