CVE-2025-61729

HighCVSS 7.5/10Last modified Oct 18, 2026

Description

Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published: Dec 2, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-61737.2A vulnerability classified as critical was found in Webkul QloApps 1.6.1. Affected by this vulnerability is an unknown functionality of the CVE-2025-617305.3During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello a CVE-2025-617317.8Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. T CVE-2025-617328.6A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.CVE-2025-617337.5Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4.0.0 through CVE-2025-617347.5Files or Directories Accessible to External Parties vulnerability in Apache Kylin. You are fine as long as the Kylin's system and project a CVE-2025-617357.3Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. You are fine a CVE-2025-617367.1Successful exploitation of this vulnerability could result in the product failing to re-establish communication once the certificate expires CVE-2025-617382.3Under certain circumstances, attacker can capture the network key, read or write encrypted packets on the PowerG network.CVE-2025-617397.2Due to Nonce reuse, attackers can perform reply attack or decrypt captured packets.CVE-2025-61746.1The Qwizcards | online quizzes and flashcards WordPress plugin through 3.9.4 does not sanitise and escape the "_stylesheet" parameter before CVE-2025-617407.2Authentication issue that does not verify the source of a packet which could allow an attacker to create a denial-of-service condition or mo