CVE-2025-61726 is a vulnerability in the Go net/url package where no limit is enforced on the number of unique query parameters parsed by net/http.Request.ParseForm. An attacker can craft an HTTP request with a large number of unique query parameters, causing excessive memory consumption and resulting in a denial of service by crashing or hanging the application. This affects applications using this Go package, including Red Hat Quay 3.9.19. The vulnerability impacts availability only, with no confidentiality or integrity impact. Red Hat rates this vulnerability as important (high severity) and recommends updating the affected package. No practical mitigation other than updating is available. The vulnerability is tracked under CWE-770 (Allocation of Resources Without Limits or Throttling).

Successful exploitation results in denial of service due to excessive memory consumption when parsing a large number of unique query parameters in HTTP requests. This causes the affected application to crash or become unresponsive, impacting availability. There is no impact on confidentiality or integrity.

Red Hat advises updating to the fixed version of Red Hat Quay 3.9.19 as soon as possible. No practical mitigation other than applying the update has been identified. Ensure all previously released errata relevant to your system are applied before updating. Monitor Red Hat advisories for any further updates.