CVE-2025-61729 is a denial of service vulnerability in the golang crypto/x509 package, specifically in the HostnameError.Error() function. When a specially crafted certificate is processed, unbounded string concatenation occurs during error string construction, causing excessive CPU and memory consumption. This flaw can be exploited remotely by an attacker to cause resource exhaustion and disrupt service availability. The vulnerability affects Red Hat Trusted Artifact Signer (RHTAS) Operator used with OpenShift Container Platform versions 4.15 to 4.19. The Red Hat advisory (RHSA-2026:2921) does not currently provide a patch or fix for this issue. The vulnerability is tracked alongside CVE-2025-65945 but no fixes are noted for either.

Successful exploitation results in denial of service due to excessive resource consumption (CPU, memory) caused by unbounded string concatenation in error handling code. This can degrade system performance or cause service outages in affected deployments of Red Hat Trusted Artifact Signer. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild at this time.

No official fix or patch is currently available for this vulnerability as per the Red Hat advisory RHSA-2026:2921. Users should monitor Red Hat security advisories for updates. Since this is a denial of service vulnerability triggered by processing crafted certificates, limiting exposure to untrusted certificate inputs or applying network-level protections to restrict attacker access may reduce risk. Customers with Red Hat Technical Account Managers (TAM) can seek direct guidance. No vendor-stated mitigations or workarounds are documented in the advisory.