CVE-2025-61728 is a denial of service vulnerability in the Go archive/zip package due to a super-linear file name indexing algorithm. When a Go application processes a maliciously crafted zip archive with a specific arrangement of file names, it can consume excessive CPU and memory resources, causing the application to become unresponsive or crash. This vulnerability affects Red Hat OpenShift Dev Spaces versions >=3.27.0 <=3.27.1 and OpenShift Data Foundation versions >=4.19.0 <=4.19.19 among others. The flaw does not impact confidentiality or integrity but results in high availability impact. Red Hat classifies this as a high severity issue. The vendor advisory recommends implementing timeouts in processing logic to mitigate the risk. No explicit patch or update is confirmed in the advisory content provided.

The vulnerability causes excessive CPU and memory consumption in Go applications using the archive/zip package when processing crafted zip archives. This results in denial of service by making the application unresponsive or causing it to crash. There is no impact on confidentiality or integrity. The availability impact is high. No known exploits in the wild have been reported.

Red Hat advises implementing a timeout mechanism in the archive/zip processing logic to abort operations that exceed a few seconds, preventing excessive resource consumption. Users should monitor Red Hat advisories for any official patches or updates. Since no explicit patch is confirmed in the advisory, applying mitigations is currently the recommended approach.