Go 1.25.2/1.24.8 Security Update: 10 CVEs Fixed (CVE-2025-61725/58187/58189/61723)

From this webpage screenshot, the following key information about the vulnerability can be obtained: Released Versions: Go 1.25.2 and Go 1.24.8 Release Date: October 8, 2025 Number of Security Fixes: 10 security fixes Vulnerability Details 1. net/mail: excessive CPU consumption in ParseAddress - Description: The function consumes excessive CPU when parsing large domain literal components due to repeated string concatenations. - CVE ID: CVE-2025-61725 - Related Issue: https://go.dev/issue/75680 2. crypto/x509: quadratic complexity when checking name constraints - Description: The name constraints checking algorithm has quadratic complexity for certain inputs, meaning processing time does not scale linearly with certificate size. - Impact: Programs that validate arbitrary certificate chains. - CVE ID: CVE-2025-58187 - Related Issue: https://go.dev/issue/75681 3. crypto/tls: ALPN negotiation errors can contain arbitrary text - Description: When ALPN negotiation fails, the method may return errors containing attacker-controlled information. - Impact: Programs that log these errors without additional sanitization. - CVE ID: CVE-2025-58189 - Related Issue: https://go.dev/issue/75652 4. encoding/pem: quadratic complexity when parsing some invalid inputs - Description: The PEM parsing function has quadratic complexity for certain invalid inputs, meaning processing time does not scale linearly with input size. - Impact: Programs that parse untrusted PEM inputs. - CVE ID: CVE-2025-61723 - Related Issue: https://go.dev/issue/75676

Goal Reached Thanks to every supporter — we hit 100%!

Go 1.25.2/1.24.8 Security Update: 10 CVEs Fixed (CVE-2025-61725/58187/58189/61723)