CVE-2025-61724 Go Reader.ReadResponse 拒绝服务漏洞

package main import ( "fmt" "strings" ) // Vulnerable function - simulates Reader.ReadResponse func ReadResponseVulnerable(lineCount int) string { result := "" for i := 0; i < lineCount; i++ { result += fmt.Sprintf("line%d: data\n", i) // Inefficient concatenation } return result } // Fixed function - uses strings.Builder func ReadResponseFixed(lineCount int) string { var builder strings.Builder for i := 0; i < lineCount; i++ { builder.WriteString(fmt.Sprintf("line%d: data\n", i)) } return builder.String() } func main() { lineCount := 100000 // Large number of lines fmt.Printf("Testing with %d lines\n", lineCount) // Vulnerable version - high CPU usage resultV := ReadResponseVulnerable(lineCount) fmt.Printf("Vulnerable version completed, length: %d\n", len(resultV)) // Fixed version - efficient resultF := ReadResponseFixed(lineCount) fmt.Printf("Fixed version completed, length: %d\n", len(resultF)) } // Attack scenario: // 1. Attacker controls data source or performs MITM attack // 2. Attacker sends response with 100,000+ lines // 3. Target application calls ReadResponse() // 4. O(n²) string concatenation causes CPU spike // 5. Service becomes unresponsive or crashes