Critical Denial of Service Vulnerability in Go Toolset and Related Packages
Summary
ALSA-2026:0923: Important: golang security update. Affects go-toolset versions < 1.25.5-2.el9_7. Fixed in 1.25.5-2.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Go Toolset is a collection of tools for the Go programming language, which is widely used for building scalable and high-performance applications. It includes the Go compiler, standard libraries, and various tools for testing and documentation. This package is essential for developers working in the Go ecosystem, but it has been found vulnerable to a Denial of Service (DoS) attack due to excessive resource consumption when processing crafted certificates.
Vulnerability Detail
The vulnerability, identified as CVE-2025-61729, arises from the crypto/x509 package in Go, which can lead to a Denial of Service. Attackers can exploit this vulnerability by sending specially crafted certificates that cause the Go application to consume excessive resources, potentially leading to application crashes or unresponsiveness. This issue highlights the importance of validating input and managing resource consumption effectively in cryptographic operations.
How To Fix
Minimum fixed version
1.25.5-2.el9_7
This is the first release that contains the fix.
sudo dnf update go-toolsetTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available updates to mitigate the risk.
Conclusion
The vulnerability CVE-2025-61729 poses a significant risk to applications using the Go Toolset and related packages, allowing for Denial of Service attacks through crafted certificates. It is essential to update to the patched version to ensure the security and stability of your applications.
See every vulnerability recorded for go-toolset →
FAQ
CVE-2025-61729 is a vulnerability in the Go programming language's crypto/x509 package that can lead to Denial of Service due to excessive resource consumption from crafted certificates.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability can lead to application crashes or unresponsiveness, affecting the availability of services relying on the Go Toolset.
Yes, the patched version for the affected packages is 1.25.5-2.el9_7. It is recommended to update to this version to mitigate the vulnerability.
While there are no specific workarounds, it is advisable to monitor your application closely for any unusual behavior and plan to apply the updates as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for go-toolset.
