CVE-2025-61723: stdlib Package Vulnerability - Quadratic Complexity in PEM Parsing
Summary
CVE-2025-61723: encoding/pem: Quadratic complexity when parsing some invalid inputs in encoding/pem. Affects stdlib versions < 1.24.8, 1.25.2. Fixed in 1.24.8, 1.25.2. How to fix ↓
Also tracked for
The same CVE-2025-61723 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package in Go provides essential standard library functionalities, including encoding and decoding of various data formats. One of its components, encoding/pem, is responsible for handling PEM (Privacy-Enhanced Mail) encoded data, which is widely used for encoding cryptographic keys and certificates. This package is critical for applications that require secure communications and data integrity. However, it is susceptible to a vulnerability that affects its performance when parsing certain invalid inputs.
Vulnerability Detail
The vulnerability identified as CVE-2025-61723 arises from the encoding/pem component's handling of invalid inputs. The processing time for parsing these inputs scales non-linearly with the size of the input, leading to potential denial-of-service conditions. This can be exploited by attackers who provide maliciously crafted PEM data, causing applications to hang or crash due to excessive processing time. The severity of this vulnerability is classified as medium, with a CVSS score of 7.5, indicating a significant risk to affected systems.
How To Fix
Minimum fixed version
1.24.8, 1.25.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that your application validates and sanitizes all PEM inputs before processing them. This can help mitigate the risk of denial-of-service attacks by rejecting malformed or suspicious data.
Conclusion
CVE-2025-61723 is a significant vulnerability in the stdlib package's encoding/pem component, which can lead to performance issues when handling invalid inputs. It is crucial for developers to update to the fixed versions and implement input validation to safeguard their applications.
See every vulnerability recorded for stdlib →
FAQ
CVE-2025-61723 is a vulnerability in the stdlib package of Go that affects the encoding/pem component, leading to quadratic complexity when parsing certain invalid inputs.
This vulnerability can cause your application to hang or crash when processing maliciously crafted PEM data, potentially leading to denial-of-service conditions.
You should update the stdlib package to version 1.24.8 or 1.25.2 to mitigate the vulnerability.
Yes, you can validate and sanitize all PEM inputs before processing them to reduce the risk of exploitation.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
