# CVE-2025-61724: Excessive CPU consumption in Reader.ReadResponse in net/textproto CVE-2025-61724 is fixed in 46 products on 1 platform, first by SUSE-SU-2025:03547-1, released October 11, 2025. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2025-61724 - Priority: High - CVSS: 7.5 (Moderate) - EPSS: 0.0056 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Oct 11, 2025 - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-61724 ## Description This update for go1.24 fixes the following issues: go1.24.9 (released 2025-10-13) includes fixes to the crypto/x509 package. (bsc#1236217) * crypto/x509: TLS validation fails for FQDNs with trailing dot go1.24.8 (released 2025-10-07) includes security fixes to the archive/tar, crypto/tls, crypto/x509, encoding/asn1, encoding/pem, net/http, net/mail, net/textproto, and net/url packages, as well as bug fixes to the compiler, the linker, and the debug/pe, net/http, os, and sync/atomic packages. (bsc#1236217) CVE-2025-58189 CVE-2025-61725 CVE-2025-58188 CVE-2025-58185 CVE-2025-58186 CVE-2025-61723 CVE-2025-58183 CVE-2025-47912 CVE-2025-58187 CVE-2025-61724: * bsc#1251255 CVE-2025-58189: crypto/tls: ALPN negotiation error contains attacker controlled information * bsc#1251253 CVE-2025-61725: net/mail: excessive CPU consumption in ParseAddress * bsc#1251260 CVE-2025-58188: crypto/x509: panic when validating certificates with DSA public keys * bsc#1251258 CVE-2025-58185: encoding/asn1: pre-allocating memory when parsing DER payload can cause memory exhaustion * bsc#1251259 CVE-2025-58186: net/http: lack of limit when parsing cookies can cause memory exhaustion * bsc#1251256 CVE-2025-61723: encoding/pem: quadratic complexity when parsing some invalid inputs * bsc#1251261 CVE-2025-58183: archive/tar: unbounded allocation when parsing GNU sparse map * bsc#1251257 CVE-2025-47912: net/url: insufficient validation of bracketed IPv6 hostnames * bsc#1251254 CVE-2025-58187: crypto/x509: quadratic complexity when checking name constraints * bsc#1251262 CVE-2025-61724: net/textproto: excessive CPU consumption in Reader.ReadResponse * os: Root.OpenRoot sets incorrect name, losing prefix of original root * debug/pe: pe.Open fails on object files produced by llvm-mingw 21 * cmd/link: panic on riscv64 with CGO enabled due to empty container symbol * net: new test TestIPv4WriteMsgUDPAddrPortTargetAddrIPVersion fails on plan9 * os: new test TestOpenFileCreateExclDanglingSymlink fails on Plan 9 * crypto/internal/fips140/rsa: requires a panic if self-tests fail * net/http: internal error: connCount underflow * cmd/compile: internal compiler error with GOEXPERIMENT=cgocheck2 on github.com/leodido/go-urn * sync/atomic: comment for Uintptr.Or incorrectly describes return value ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | amazon-cloudwatch-agent amzn 2023 | 1.300060.1-1.amzn2023 | [ALAS2023-2025-1275](https://patchblox.com/security/data/fix/linux/alas2023-2025-1275.md) | Nov 10, 2025 | | Linux | amazon-ecr-credential-helper amzn 2023 | 0.10.1-3.amzn2023 | [ALAS2023-2025-1271](https://patchblox.com/security/data/fix/linux/alas2023-2025-1271.md) | Nov 10, 2025 | | Linux | amazon-ssm-agent amzn 2023 | 3.3.3572.0-1.amzn2023 | [ALAS2023-2025-1359](https://patchblox.com/security/data/fix/linux/alas2023-2025-1359.md) | Jan 7, 2026 | | Linux | captree amzn 2023 | 2.73-1.amzn2023.0.4 | [ALAS2023-2025-1279](https://patchblox.com/security/data/fix/linux/alas2023-2025-1279.md) | Nov 10, 2025 | | Linux | captree-debuginfo amzn 2023 | 2.73-1.amzn2023.0.4 | [ALAS2023-2025-1279](https://patchblox.com/security/data/fix/linux/alas2023-2025-1279.md) | Nov 10, 2025 | | Linux | cni-plugins amzn 2023 | 1.7.1-1.amzn2023.0.3 | [ALAS2023-2025-1287](https://patchblox.com/security/data/fix/linux/alas2023-2025-1287.md) | Dec 8, 2025 | | Linux | cni-plugins-debuginfo amzn 2023 | 1.7.1-1.amzn2023.0.3 | [ALAS2023-2025-1287](https://patchblox.com/security/data/fix/linux/alas2023-2025-1287.md) | Dec 8, 2025 | | Linux | cni-plugins-debugsource amzn 2023 | 1.7.1-1.amzn2023.0.3 | [ALAS2023-2025-1287](https://patchblox.com/security/data/fix/linux/alas2023-2025-1287.md) | Dec 8, 2025 | | Linux | containerd amzn 2023 | 2.1.4-1.amzn2023.0.2 | [ALAS2023-2025-1272](https://patchblox.com/security/data/fix/linux/alas2023-2025-1272.md) | Nov 10, 2025 | | Linux | containerd-debuginfo amzn 2023 | 2.1.4-1.amzn2023.0.2 | [ALAS2023-2025-1272](https://patchblox.com/security/data/fix/linux/alas2023-2025-1272.md) | Nov 10, 2025 | | Linux | containerd-debugsource amzn 2023 | 2.1.4-1.amzn2023.0.2 | [ALAS2023-2025-1272](https://patchblox.com/security/data/fix/linux/alas2023-2025-1272.md) | Nov 10, 2025 | | Linux | containerd-stress amzn 2023 | 2.1.4-1.amzn2023.0.2 | [ALAS2023-2025-1272](https://patchblox.com/security/data/fix/linux/alas2023-2025-1272.md) | Nov 10, 2025 | | Linux | containerd-stress-debuginfo amzn 2023 | 2.1.4-1.amzn2023.0.2 | [ALAS2023-2025-1272](https://patchblox.com/security/data/fix/linux/alas2023-2025-1272.md) | Nov 10, 2025 | | Linux | docker amzn 2023 | 25.0.13-1.amzn2023.0.2 | [ALAS2023-2025-1274](https://patchblox.com/security/data/fix/linux/alas2023-2025-1274.md) | Nov 10, 2025 | | Linux | docker-debuginfo amzn 2023 | 25.0.13-1.amzn2023.0.2 | [ALAS2023-2025-1274](https://patchblox.com/security/data/fix/linux/alas2023-2025-1274.md) | Nov 10, 2025 | | Linux | docker-debugsource amzn 2023 | 25.0.13-1.amzn2023.0.2 | [ALAS2023-2025-1274](https://patchblox.com/security/data/fix/linux/alas2023-2025-1274.md) | Nov 10, 2025 | | Linux | ecs-init amzn 2023 | 1.101.0-1.amzn2023 | [ALAS2023-2025-1295](https://patchblox.com/security/data/fix/linux/alas2023-2025-1295.md) | Dec 8, 2025 | | Linux | go1.24 opensuse-leap 15.6 | 1.24.9-150000.1.42.1 | [SUSE-SU-2025:3682-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3682-1.md) | Oct 20, 2025 | | Linux | go1.24 opensuse-leap 16.0 | 1.24.11-160000.1.1 | [OPENSUSE-SU-2025:20158-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2025-20158-1.md) | Dec 12, 2025 | | Linux | go1.24 sles 15.6 | 1.24.9-150000.1.42.1 | [SUSE-SU-2025:3682-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3682-1.md) | Oct 20, 2025 | | Linux | go1.24 sles 15.7 | 1.24.9-150000.1.42.1 | [SUSE-SU-2025:3682-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3682-1.md) | Oct 20, 2025 | | Linux | go1.24 sles 16.0 | 1.24.11-160000.1.1 | [SUSE-SU-2025:21193-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-21193-1.md) | Dec 12, 2025 | | Linux | go1.24-openssl opensuse-leap 15.6 | 1.24.12-150600.13.15.1 | [SUSE-SU-2026:0308-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0308-1.md) | Jan 28, 2026 | | Linux | go1.24-openssl opensuse-leap 16.0 | 1.24.13-160000.1.1 | [OPENSUSE-SU-2026:20308-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20308-1.md) | Mar 3, 2026 | | Linux | go1.24-openssl sles 15.6 | 1.24.12-150600.13.15.1 | [SUSE-SU-2026:0308-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0308-1.md) | Jan 28, 2026 | | Linux | go1.24-openssl sles 15.7 | 1.24.12-150600.13.15.1 | [SUSE-SU-2026:0308-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0308-1.md) | Jan 28, 2026 | | Linux | go1.24-openssl sles 16.0 | 1.24.13-160000.1.1 | [SUSE-SU-2026:20629-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-20629-1.md) | Mar 3, 2026 | | Linux | go1.25 opensuse-leap 15.6 | 1.25.2-150000.1.14.1 | [SUSE-SU-2025:03547-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03547-1.md) | Oct 11, 2025 | | Linux | go1.25 opensuse-leap 16.0 | 1.25.5-160000.1.1 | [OPENSUSE-SU-2025:20157-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2025-20157-1.md) | Dec 12, 2025 | | Linux | go1.25 sles 15.6 | 1.25.2-150000.1.14.1 | [SUSE-SU-2025:03547-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03547-1.md) | Oct 11, 2025 | | Linux | go1.25 sles 15.7 | 1.25.2-150000.1.14.1 | [SUSE-SU-2025:03547-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03547-1.md) | Oct 11, 2025 | | Linux | go1.25 sles 16.0 | 1.25.5-160000.1.1 | [SUSE-SU-2025:21192-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-21192-1.md) | Dec 12, 2025 | | Linux | go1.25-openssl opensuse-leap 15.6 | 1.25.6-150600.13.9.1 | [SUSE-SU-2026:0298-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0298-1.md) | Jan 26, 2026 | | Linux | go1.25-openssl opensuse-leap 16.0 | 1.25.7-160000.1.1 | [OPENSUSE-SU-2026:20301-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20301-1.md) | Mar 3, 2026 | | Linux | go1.25-openssl sles 15.6 | 1.25.6-150600.13.9.1 | [SUSE-SU-2026:0298-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0298-1.md) | Jan 26, 2026 | | Linux | go1.25-openssl sles 15.7 | 1.25.6-150600.13.9.1 | [SUSE-SU-2026:0298-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0298-1.md) | Jan 26, 2026 | | Linux | go1.25-openssl sles 16.0 | 1.25.7-160000.1.1 | [SUSE-SU-2026:20623-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-20623-1.md) | Mar 3, 2026 | | Linux | golang amzn 2023 | 1.24.8-1.amzn2023.0.1 | [ALAS2023-2025-1239](https://patchblox.com/security/data/fix/linux/alas2023-2025-1239.md) | Oct 27, 2025 | | Linux | golang-bin amzn 2023 | 1.24.8-1.amzn2023.0.1 | [ALAS2023-2025-1239](https://patchblox.com/security/data/fix/linux/alas2023-2025-1239.md) | Oct 27, 2025 | | Linux | golang-docs amzn 2023 | 1.24.8-1.amzn2023.0.1 | [ALAS2023-2025-1239](https://patchblox.com/security/data/fix/linux/alas2023-2025-1239.md) | Oct 27, 2025 | | Linux | golang-misc amzn 2023 | 1.24.8-1.amzn2023.0.1 | [ALAS2023-2025-1239](https://patchblox.com/security/data/fix/linux/alas2023-2025-1239.md) | Oct 27, 2025 | | Linux | golang-shared amzn 2023 | 1.24.8-1.amzn2023.0.1 | [ALAS2023-2025-1239](https://patchblox.com/security/data/fix/linux/alas2023-2025-1239.md) | Oct 27, 2025 | | Linux | golang-src amzn 2023 | 1.24.8-1.amzn2023.0.1 | [ALAS2023-2025-1239](https://patchblox.com/security/data/fix/linux/alas2023-2025-1239.md) | Oct 27, 2025 | | Linux | golang-tests amzn 2023 | 1.24.8-1.amzn2023.0.1 | [ALAS2023-2025-1239](https://patchblox.com/security/data/fix/linux/alas2023-2025-1239.md) | Oct 27, 2025 | | Linux | golist amzn 2023 | 0.10.1-11.amzn2023.0.5 | [ALAS2023-2025-1276](https://patchblox.com/security/data/fix/linux/alas2023-2025-1276.md) | Nov 10, 2025 | | Linux | golist-debuginfo amzn 2023 | 0.10.1-11.amzn2023.0.5 | [ALAS2023-2025-1276](https://patchblox.com/security/data/fix/linux/alas2023-2025-1276.md) | Nov 10, 2025 | | Linux | golist-debugsource amzn 2023 | 0.10.1-11.amzn2023.0.5 | [ALAS2023-2025-1276](https://patchblox.com/security/data/fix/linux/alas2023-2025-1276.md) | Nov 10, 2025 | | Linux | govulncheck-vulndb opensuse-leap 16.0 | 0.0.20260723T184607-160000.1.1 | [OPENSUSE-SU-2026:21483-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21483-1.md) | Jul 30, 2026 | | Linux | libcap amzn 2023 | 2.73-1.amzn2023.0.4 | [ALAS2023-2025-1279](https://patchblox.com/security/data/fix/linux/alas2023-2025-1279.md) | Nov 10, 2025 | | Linux | libcap-debuginfo amzn 2023 | 2.73-1.amzn2023.0.4 | [ALAS2023-2025-1279](https://patchblox.com/security/data/fix/linux/alas2023-2025-1279.md) | Nov 10, 2025 | | Linux | libcap-debugsource amzn 2023 | 2.73-1.amzn2023.0.4 | [ALAS2023-2025-1279](https://patchblox.com/security/data/fix/linux/alas2023-2025-1279.md) | Nov 10, 2025 | | Linux | libcap-devel amzn 2023 | 2.73-1.amzn2023.0.4 | [ALAS2023-2025-1279](https://patchblox.com/security/data/fix/linux/alas2023-2025-1279.md) | Nov 10, 2025 | | Linux | libcap-static amzn 2023 | 2.73-1.amzn2023.0.4 | [ALAS2023-2025-1279](https://patchblox.com/security/data/fix/linux/alas2023-2025-1279.md) | Nov 10, 2025 | | Linux | nerdctl amzn 2023 | 2.1.5-1.amzn2023.0.2 | [ALAS2023-2025-1278](https://patchblox.com/security/data/fix/linux/alas2023-2025-1278.md) | Nov 10, 2025 | | Linux | oci-add-hooks amzn 2023 | 0-0.1.20200504git268e3bb.amzn2023.0.6 | [ALAS2023-2025-1273](https://patchblox.com/security/data/fix/linux/alas2023-2025-1273.md) | Nov 10, 2025 | | Linux | oci-add-hooks-debuginfo amzn 2023 | 0-0.1.20200504git268e3bb.amzn2023.0.6 | [ALAS2023-2025-1273](https://patchblox.com/security/data/fix/linux/alas2023-2025-1273.md) | Nov 10, 2025 | | Linux | oci-add-hooks-debugsource amzn 2023 | 0-0.1.20200504git268e3bb.amzn2023.0.6 | [ALAS2023-2025-1273](https://patchblox.com/security/data/fix/linux/alas2023-2025-1273.md) | Nov 10, 2025 | | Linux | runc amzn 2023 | 1.3.3-2.amzn2023.0.1 | [ALAS2023-2025-1286](https://patchblox.com/security/data/fix/linux/alas2023-2025-1286.md) | Nov 10, 2025 | | Linux | runc-debuginfo amzn 2023 | 1.3.3-2.amzn2023.0.1 | [ALAS2023-2025-1286](https://patchblox.com/security/data/fix/linux/alas2023-2025-1286.md) | Nov 10, 2025 | | Linux | runc-debugsource amzn 2023 | 1.3.3-2.amzn2023.0.1 | [ALAS2023-2025-1286](https://patchblox.com/security/data/fix/linux/alas2023-2025-1286.md) | Nov 10, 2025 | | Linux | runfinch-finch amzn 2023 | 1.10.0-1.amzn2023.0.5 | [ALAS2023-2025-1270](https://patchblox.com/security/data/fix/linux/alas2023-2025-1270.md) | Nov 10, 2025 | | Linux | soci-snapshotter amzn 2023 | 0.11.1-1.amzn2023.0.3 | [ALAS2023-2025-1277](https://patchblox.com/security/data/fix/linux/alas2023-2025-1277.md) | Nov 10, 2025 | --- Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.