CVE-2025-61725: stdlib Package Suffers from Excessive CPU Consumption in ParseAddress Function
Summary
CVE-2025-61725: net/mail: Excessive CPU consumption in ParseAddress in net/mail. Affects stdlib versions < 1.24.8, 1.25.2. Fixed in 1.24.8, 1.25.2. How to fix ↓
Also tracked for
The same CVE-2025-61725 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package in Go provides a collection of standard libraries for various functionalities, including networking, file handling, and more. It is widely used in Go applications for its reliability and performance. However, the ParseAddress function within the net/mail subpackage has been identified to have a vulnerability that can lead to excessive CPU consumption when processing large domain-literal address components.
Vulnerability Detail
The vulnerability arises from the way the ParseAddress function constructs domain-literal address components through repeated string concatenation. This inefficient handling can lead to significant CPU resource consumption, especially when parsing large inputs. As a result, applications utilizing this function may experience performance degradation, potentially leading to denial of service if exploited. The vulnerability has been classified with a CVSS score of 7.5, indicating a medium severity level.
How To Fix
Minimum fixed version
1.24.8, 1.25.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing input validation to restrict the size of domain-literal components being processed by the ParseAddress function. This can help mitigate excessive CPU usage until the package is updated.
Conclusion
CVE-2025-61725 highlights a significant vulnerability in the stdlib package's ParseAddress function, which can lead to excessive CPU consumption. It is crucial for developers to update to the patched versions to ensure application performance and security. Utilizing tools like Vulert can help in monitoring vulnerabilities effectively.
See every vulnerability recorded for stdlib →
FAQ
CVE-2025-61725 is a vulnerability in the stdlib package's ParseAddress function that can lead to excessive CPU consumption when parsing large domain-literal address components.
If your application uses the ParseAddress function, it may experience performance issues, including high CPU usage, which could lead to denial of service.
The vulnerability affects stdlib version v1.24.6 and earlier. It is fixed in versions 1.24.8 and 1.25.2.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
If an immediate update is not possible, implement input validation to limit the size of inputs to the ParseAddress function as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
