VDB

CVE-2025-61726

CVE-2025-61726 PUBLISHED CVSS 7.5 HIGH

Memory exhaustion in query parameter parsing in net/url

Reported by go · Published January 28, 2026

The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
kuma-2.12Wolfi2.12.3-r4
docker-credential-ecr-loginChainguard0.11.0-r2
osbuild-composer-workererrata.rockylinux.org165.1-2.el9, 165.1-2.el10, 0.8
sopsChainguard3.11.0-r4
sftpgo-plugin-authChainguard1.0.13-r3
agentbeatChainguard9.2.4-r1
mountpoint-s3-csi-driver-2.2Wolfi2.2.2-r1
beats-fips-7Chainguard7.17.29-r9
spiffe-helper-fipsChainguard0.11.0-r2
spegelChainguard0.6.0-r2
crossplane-provider-aws-kinesisChainguard2.3.0-r3
maruChainguard0.6.0-r7

32 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

VendorProductVersions
Go standard librarynet/url0, 1.25.0
Red HatMulticluster Global Hub 1.5.71773650627
wolfikuma-2.120
Red HatRed Hat OpenShift distributed tracing 3.9.01771517356
Red HatRed Hat OpenShift Container Platform 4.141777994001
Red HatRed Hat Quay 3.101773971077
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.141783329407
chainguarddocker-credential-ecr-login0
Red HatRed Hat OpenShift Container Platform 4.181772594905
Red HatRed Hat OpenShift Container Platform 4.161776697799
Red HatRed Hat OpenShift AI 2.251776768333
chainguardsops0
Red HatRed Hat Web Terminal 1.151775672765
Red HatRed Hat Update Infrastructure 51773670137
Red HatRed Hat OpenShift Container Platform 4.181772154094
Red HatRed Hat OpenShift Container Platform 4.181772156809
Red HatRed Hat Ansible Automation Platform 2.4 for RHEL 9
Red HatRed Hat Advanced Cluster Management for Kubernetes 2
Red HatLogging Subsystem for Red Hat OpenShift 6.31773409854
chainguardsftpgo-plugin-auth0

…and 4916 more

Timeline

  • Jan 15, 2026 CVE Published
  • Jan 29, 2026 EPSS Score (30 in total, the first dated here)
  • Mar 17, 2026 Distribution Patch (382 in total, the first dated here)
  • Mar 17, 2026 Security Advisory (368 in total, the first dated here)
  • Mar 26, 2026 Coalition ESS Score (2 in total, the first dated here)

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2025-61726
vulnetix vdb fixes CVE-2025-61726

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-61726/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

…and 268 more

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›