CVE-2025-61729: Excessive Resource Consumption in Bitnami Golang Due to Host Certificate Validation Error String Construction
Summary
CVE-2025-61729: Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Affects golang across 2 version ranges.
< 1.24.11
>= 1.25.0, < 1.25.5
Fixed in 1.24.11 or 1.25.5, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2025-61729 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Golang, developed by Google, is a statically typed, compiled programming language designed for simplicity and efficiency. It is widely used for building web servers, data pipelines, and other software applications. The package in question, Bitnami Golang, is a distribution of the Go programming language that is optimized for deployment in cloud environments. This specific vulnerability arises from the way error strings are constructed during host certificate validation, potentially leading to performance issues.
Vulnerability Detail
The vulnerability is found in the HostnameError.Error() method, which constructs an error string without limiting the number of hosts printed. This can lead to excessive resource consumption, especially when a malicious actor provides a certificate with numerous hosts. The string concatenation method used for constructing the error string results in quadratic runtime complexity, which can severely impact application performance and lead to denial of service.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.24.111.24.11 -
>= 1.25.0, < 1.25.51.25.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can limit the number of hosts printed in error messages by modifying the error handling logic in your application to truncate the output or log only a subset of the hosts.
Conclusion
CVE-2025-61729 is a significant vulnerability in the Bitnami Golang package that can lead to excessive resource consumption. It is crucial to update to the patched versions to mitigate the risk. Implementing workarounds can provide temporary relief until an update is feasible.
See every vulnerability recorded for golang →
FAQ
CVE-2025-61729 is a vulnerability in the Bitnami Golang package that allows excessive resource consumption due to unbounded error string construction during host certificate validation.
If your application uses the affected versions of Bitnami Golang, it may experience performance degradation or denial of service due to excessive resource consumption when handling certain certificates.
The vulnerability affects all versions prior to 1.24.11 and 1.25.5, including versions 1.25.0 to 1.25.4.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected by this vulnerability without any signup.
If immediate updates are not possible, implement a workaround by modifying your error handling logic to limit the number of hosts printed in error messages.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
