CVE-2025-61726 is a vulnerability in the Go standard library net/url package where no limit is enforced on the number of unique query parameters parsed by net/http.Request.ParseForm. An attacker can exploit this by sending an HTTP request with a massive number of unique query parameters, causing excessive memory consumption and leading to denial of service (application crash or unresponsiveness). This vulnerability affects applications using the vulnerable Go package, including logstash-exporter-fips versions prior to 1.9.1-r1. Red Hat has released a security fix in version 1.9.1-r1 to address this issue. The vulnerability is rated as important/high severity due to its impact on availability, with no impact on confidentiality or integrity.

Exploitation results in denial of service via resource exhaustion (memory consumption) when processing HTTP requests with many unique query parameters. This can cause the affected application to crash or become unresponsive, impacting availability. There is no impact on confidentiality or integrity.

A patch is available in logstash-exporter-fips version 1.9.1-r1 and later. Users should update to this fixed version as soon as possible. Red Hat has not identified any practical mitigations other than applying the update.