Repository navigation
net/mail: excessive CPU consumption in ParseAddress (CVE-2025-61725) #75680
Description
The ParseAddress function constructed domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this could cause excessive CPU consumption.
Thanks to Philippe Antoine (Catena cyber) for reporting this issue.
This is CVE-2025-61725 and Go issue https://go.dev/issue/75680.
This is a PRIVATE issue for CVE-2025-61725, tracked in http://b/446728192 and fixed by https://go-internal-review.git.corp.google.com/c/go/+/2840.
/cc @golang/security and @golang/release
Activity
neild commentedon Oct 1, 2025
@gopherbot please open backport issues for this security fix
gopherbot commentedon Oct 1, 2025
Backport issue(s) opened: #75700 (for 1.24), #75701 (for 1.25).
Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.
gopherbot commentedon Oct 7, 2025
Change https://go.dev/cl/709835 mentions this issue:
[release-branch.go1.24] net/mail: avoid quadratic behavior in mail address parsinggopherbot commentedon Oct 7, 2025
Change https://go.dev/cl/709860 mentions this issue:
net/mail: avoid quadratic behavior in mail address parsinggopherbot commentedon Oct 7, 2025
Change https://go.dev/cl/709844 mentions this issue:
[release-branch.go1.25] net/mail: avoid quadratic behavior in mail address parsing[release-branch.go1.25] net/mail: avoid quadratic behavior in mail ad…
[release-branch.go1.24] net/mail: avoid quadratic behavior in mail ad…
[-]security: fix CVE-2025-61725[/-][+]net/mail: excessive CPU consumption in ParseAddress (CVE-2025-61725)[/+][release-branch.go1.24] net/mail: avoid quadratic behavior in mail ad…
[release-branch.go1.24] net/mail: avoid quadratic behavior in mail ad…
[release-branch.go1.24] net/mail: avoid quadratic behavior in mail ad…
[release-branch.go1.24] net/mail: avoid quadratic behavior in mail ad…
[release-branch.go1.24] net/mail: avoid quadratic behavior in mail ad…
[release-branch.go1.25] net/mail: avoid quadratic behavior in mail ad…
[release-branch.go1.25] net/mail: avoid quadratic behavior in mail ad…