CVE-2025-61726 is a denial-of-service vulnerability in the net/url package of the Go standard library, which does not limit the number of unique query parameters parsed. Applications using net/http.Request.ParseForm will attempt to process all parameters, leading to excessive memory consumption and potential application crash or unresponsiveness when processing specially crafted HTTP requests with a large number of query parameters. Red Hat has fixed this issue in their build of OpenTelemetry 3.9.0 and related components by updating the net/url package. The vulnerability affects multiple Red Hat products that include this component. The flaw is tracked as CWE-770 (Allocation of Resources Without Limits or Throttling).

An attacker capable of sending specially crafted HTTP requests with a large number of unique query parameters can cause affected applications to consume excessive memory, leading to denial of service by crashing or making the application unresponsive. There is no impact on confidentiality or integrity. The severity is rated as important/high due to the availability impact.

Red Hat advises updating the affected packages to the fixed versions as soon as possible. No practical workaround or mitigation has been identified. Users should apply the security updates provided by Red Hat, such as the OpenTelemetry 3.9.0 release and related component updates. Follow Red Hat's official documentation for upgrading affected products and components.