CVE-2025-61725

Published: Oct 29, 2025

Modified: Dec 9, 2025

PUBLISHED

Description

The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption.

Vendor	Product	Versions
Go standard library	net/mail	affected `0 - < 1.24.8` affected `1.25.0 - < 1.25.2`

References

https://go.dev/cl/709860

https://go.dev/issue/75680

https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI

https://pkg.go.dev/vuln/GO-2025-4006

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2025-61725

Description

Affected Products

References