CVE-2025-61728: Go archive/zip DoS Vulnerability

CVE-2025-61728 Overview

CVE-2025-61728 is a denial of service vulnerability in Go's archive/zip package caused by a super-linear file name indexing algorithm. The vulnerability is triggered the first time a file in an archive is opened, and can be exploited by providing a maliciously constructed ZIP archive to applications using the affected library. This algorithmic complexity attack allows remote attackers to cause resource exhaustion and service disruption.

Critical Impact
Applications processing untrusted ZIP archives are vulnerable to denial of service attacks through resource exhaustion, potentially causing system unavailability and service disruption.

Affected Products

Go archive/zip package (versions prior to the security patch)
Applications built with Go that process ZIP archives
Services accepting user-uploaded ZIP files

Discovery Timeline

2026-01-28 - CVE CVE-2025-61728 published to NVD
2026-01-29 - Last updated in NVD database

Technical Details for CVE-2025-61728

Vulnerability Analysis

This vulnerability falls under the category of Algorithmic Complexity Attack, a type of denial of service vulnerability. The archive/zip package in Go implements a file name indexing algorithm with super-linear time complexity. When an application opens a file within a ZIP archive for the first time, this indexing routine is invoked.

The flaw allows an attacker to craft a specially designed ZIP archive that exploits the inefficient algorithm, causing the indexing operation to consume excessive CPU cycles. This occurs because the algorithm's performance degrades significantly when processing archives with certain characteristics in their file name structures.

The network-based attack vector means any Go application that accepts ZIP files from untrusted sources—such as file upload endpoints, document processing systems, or archive extraction utilities—could be targeted remotely.

Root Cause

The root cause lies in the super-linear time complexity of the file name indexing algorithm within the archive/zip package. When file entries are indexed during the first file access operation, the algorithm does not efficiently handle certain input patterns, leading to computational complexity that grows faster than linear relative to the archive contents.

Attack Vector

An attacker can exploit this vulnerability by:

Crafting a malicious ZIP archive designed to trigger worst-case performance in the file name indexing algorithm
Sending the crafted archive to a target application that processes ZIP files
When the application attempts to open any file within the archive, the indexing algorithm consumes excessive resources
This results in denial of service through CPU exhaustion

The attack requires no authentication and only needs user interaction in the form of the victim application processing the malicious archive. The vulnerability affects availability without impacting confidentiality or integrity.

For technical details on the vulnerability mechanism and the specific fix, refer to the Go.dev Issue 77102 and the Go Vulnerability Advisory.

Detection Methods for CVE-2025-61728

Indicators of Compromise

Unusual CPU spikes when processing ZIP archives
Application hangs or timeouts during ZIP file extraction operations
Memory consumption anomalies in services handling archive files
Increased processing time for file open operations on ZIP contents

Detection Strategies

Monitor Go applications for abnormal resource consumption patterns when handling ZIP files
Implement timeout mechanisms for archive processing operations
Deploy application performance monitoring to detect latency spikes in file handling routines
Review application logs for repeated archive processing failures or timeouts

Monitoring Recommendations

Configure alerts for CPU utilization thresholds on services processing ZIP archives
Implement request timeout monitoring for file upload and extraction endpoints
Track archive processing duration metrics to identify anomalous patterns
Monitor system resource exhaustion indicators on servers running vulnerable Go applications

How to Mitigate CVE-2025-61728

Immediate Actions Required

Update Go to the patched version that addresses the indexing algorithm inefficiency
Implement resource limits and timeouts for ZIP archive processing operations
Consider validating ZIP archive structure before full processing
Restrict archive processing to trusted sources where possible

Patch Information

The Go development team has released a security patch addressing this vulnerability. The fix is tracked in Go.dev Issue Tracker CL 736713. Organizations should update their Go installations and rebuild affected applications to incorporate the security fix.

For additional context, consult the Golang Announce Post and the Openwall OSS Security Discussion.

Workarounds

Implement processing timeouts for ZIP archive operations to prevent indefinite resource consumption
Add resource quotas (CPU time, memory limits) for archive processing tasks
Pre-validate ZIP archives by checking file count and structure before invoking file open operations
Isolate archive processing in sandboxed environments with strict resource controls

bash

# Example: Setting resource limits for Go applications processing archives
# Use ulimit to restrict CPU time for archive processing services
ulimit -t 60  # Limit CPU time to 60 seconds

# Or use cgroups for container-based deployments
# Create a cgroup with CPU quota restrictions
cgcreate -g cpu:/archive_processor
echo 50000 > /sys/fs/cgroup/cpu/archive_processor/cpu.cfs_quota_us