CVE-2025-61723: Golang Package Vulnerability Due to Quadratic Complexity in PEM Parsing
Summary
CVE-2025-61723: Quadratic complexity when parsing some invalid inputs in encoding/pem. Affects golang across 2 version ranges.
< 1.24.8
>= 1.25.0, < 1.25.2
Fixed in 1.24.8 or 1.25.2, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2025-61723 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Golang, developed by Google, is an open-source programming language designed for simplicity and efficiency. It is widely used for building web servers, data pipelines, and other software solutions. The encoding/pem package in Golang is responsible for encoding and decoding PEM (Privacy-Enhanced Mail) data, which is commonly used for cryptographic keys and certificates. This package is crucial for applications that handle secure communications. However, it is susceptible to a vulnerability that can lead to performance degradation when processing invalid inputs.
Vulnerability Detail
The vulnerability arises from the way the encoding/pem package handles certain invalid inputs. When parsing these inputs, the processing time increases non-linearly with the size of the input, leading to quadratic complexity. This can be exploited by an attacker who provides untrusted PEM data, potentially causing denial of service (DoS) by consuming excessive CPU resources. The vulnerability affects any application that relies on the encoding/pem package to parse PEM data without proper validation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.24.81.24.8 -
>= 1.25.0, < 1.25.21.25.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that all PEM inputs are validated before parsing. Implement input validation checks to reject any malformed or suspicious data that could trigger the vulnerability. For example, you can use a regex pattern to check the format of the PEM data before processing it.
Conclusion
CVE-2025-61723 represents a significant vulnerability in the Golang encoding/pem package, leading to potential denial of service through quadratic complexity in parsing invalid inputs. It is crucial for developers to update their Golang packages to the patched versions and implement input validation to mitigate risks.
See every vulnerability recorded for golang →
FAQ
CVE-2025-61723 is a vulnerability in the Golang encoding/pem package that allows for quadratic complexity when parsing certain invalid inputs, potentially leading to denial of service.
An attacker can exploit this vulnerability by supplying untrusted PEM data that is malformed, causing the application to consume excessive CPU resources during parsing.
Versions of Golang prior to 1.24.8 and 1.25.2 are affected by this vulnerability. It is recommended to upgrade to one of the fixed versions.
If immediate updating is not possible, implement input validation to reject malformed PEM data as a temporary workaround.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
