Threats affecting pkg:golang/archive/zip

CVE-2025-61728 is a medium severity vulnerability in the Go standard library's archive/zip package, caused by an inefficient super-linear file name indexing algorithm. When a file in a ZIP archive is opened for the first time, this algorithm is triggered, which can be exploited by a maliciously crafted ZIP archive to cause a denial of service (DoS) by consuming excessive CPU resources. The vulnerability affects all versions up to and including Go 1.25.0. Exploitation requires no privileges but does require user interaction to open a ZIP file. There are no known exploits in the wild yet, and no patches have been published at the time of this report. European organizations using Go for processing ZIP archives in network-facing or user-facing applications are at risk of service disruption. Mitigation involves avoiding untrusted ZIP files, implementing resource limits on ZIP processing, and monitoring for abnormal CPU usage. Countries with significant software development industries and critical infrastructure relying on Go, such as Germany, France, and the UK, are more likely to be impacted.

EPSS 0.7%VulnerabilityCWE-407Germany+2