CVE-2025-61728

MediumCVSS 6.5

Published: 28/01/2026(UTC)Updated: 17/06/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Summary

The archive/zip package uses a super-linear file name indexing algorithm invoked the first time a file in an archive is opened. Consuming a maliciously constructed ZIP archive can lead to a denial of service.

Risk Assessment

An application or service processing untrusted ZIP archives may be overloaded, leading to service unavailability. The risk affects systems accepting archives from users.

Recommendation

Update the Go environment to a version containing the fix for this issue. Limit the size and complexity of processed ZIP archives and validate their contents.

Other vulnerabilities in Go archive/zip

CVE-2024-24789Medium
A vulnerability in the archive/zip package of Go causes its handling of certain invalid zip files to differ from most zip implementations. This discrepancy can be exploited to create a zip file whose content varies depending on the reading implementation. The archive/zip package now rejects such files.

Original NVD description (English source)

archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS