CVE-2025-61728

What it actually does

The `archive/zip` library in Go is vulnerable to a denial of service. It uses an inefficient, super-linear algorithm for indexing filenames within a ZIP archive. When an application built with a vulnerable Go version attempts to open a file from a maliciously crafted ZIP archive containing a large number of files, this algorithm is triggered, leading to excessive CPU consumption and causing the application to become unresponsive or crash.

Why it matters to the business

Applications that process ZIP files, such as those handling user uploads or data imports, can be rendered unavailable by an attacker. A successful attack would cause service downtime, disrupting business operations, impacting user experience, and potentially leading to financial loss if the service is critical. Since the attack only requires sending a malicious file, any public-facing service accepting ZIP archives is at risk.

How an attack unfolds

An attacker crafts a ZIP archive containing a very large number of files to specifically target the inefficient indexing algorithm in Go's `archive/zip` library. The attacker then submits this file to a target service that is known to be built with a vulnerable version of Go and processes ZIP files. When the application receives the archive and attempts its first file operation (e.g., reading a file from it), the vulnerable code path is executed. This triggers a computationally expensive process that consumes all available CPU resources, effectively hanging the application and causing a denial of service.

How to fix it

To remediate this vulnerability, developers must recompile their applications using a patched version of the Go toolchain. The vulnerability was fixed in commit `63a1b82d1e68ddd87652467303901593efe0ff11`. Upgrade to a Go version that includes this fix and rebuild all affected Go binaries. As a temporary mitigation, if patching is not immediately possible, consider implementing a pre-processing check to limit the number of files allowed within a single ZIP archive before it is passed to the Go application.

How to confirm the fix worked

To validate the fix, ensure that all relevant Go applications have been rebuilt with a patched Go version. You can verify the Go version used to build a binary by running `go version -m <path_to_binary>`. To test for continued exposure, you can create a test ZIP file with a large number of files (e.g., 100,000) and monitor the CPU usage of the application as it processes the file. A patched application should handle the file without significant, sustained CPU spikes, while a vulnerable one will likely become unresponsive.

Typical attack path

1. The attacker creates a malicious ZIP archive with a large number of files.
2. The attacker identifies a web service or application built with a vulnerable version of Go that accepts ZIP file uploads.
3. The attacker sends the malicious ZIP file to the target application, for example, through a file upload form or an API endpoint.
4. The Go application begins processing the archive using the vulnerable `archive/zip` library.
5. The inefficient indexing algorithm is triggered, causing CPU usage to spike to 100%, making the application unresponsive and unavailable to legitimate users.

How to detect it

Exploitation of this vulnerability manifests as a denial-of-service condition. Monitor application performance metrics for sustained high CPU usage immediately following the processing of a ZIP file. Check application logs for entries indicating the receipt or processing of a ZIP file just before a crash, hang, or period of unresponsiveness. An alert from an Application Performance Monitoring (APM) tool for high CPU on a service that handles file uploads could indicate an attack attempt.

What your security team should do

• Identify all Go applications in your environment that process ZIP files from untrusted sources and prioritize them for patching.
• Update the Go toolchain to a version containing the fix and recompile all identified applications.
• If immediate recompilation is not feasible, deploy an interim mitigation, such as an upstream service (e.g., API gateway, web application firewall) that inspects and rejects ZIP archives containing an abnormally high number of files.
• Use Software Composition Analysis (SCA) tools to scan for and inventory all Go applications and their build versions to ensure comprehensive remediation.