CVE-2025-61726

score

<0.1

cvss

7.5

epss

2.3%

published

2026-01-28

kev added

—

first seen

2026-10-21

Go net/url package contains an excessive memory consumption vulnerability caused by lack of limit on the number of query parameters in URL parsing, letting attackers cause denial of service, exploit requires sending large number of unique query parameters.