Go 1.25.5 and Go 1.24.11 are released - fix CVE-2025-61729 & CVE-2025-61727

[Alan Coopersmith <alan.coopersmith () oracle com>]

https://groups.google.com/g/golang-announce/c/8FJoBkPddm4 announces:

> Hello gophers,
>
> We have just released Go versions 1.25.5 and 1.24.11, minor point releases.
>
> These releases include 2 security fixes following the security policy:
>
>     crypto/x509: excessive resource consumption in printing error string for host certificate validation
>
>     Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will 
> be printed out.
>     Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime.
>
>     Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.
>     HostnameError.Error() now limits the number of hosts and utilizes strings.Builder when constructing an error string.
>
>     Thanks to Philippe Antoine (Catena cyber) for reporting this issue.
>
>     This is CVE-2025-61729 and Go issue https://go.dev/issue/76445.
>
>     crypto/x509: excluded subdomain constraint does not restrict wildcard SANs
>
>     An excluded subdomain constraint in a certificate chain does not restrict the
>     usage of wildcard SANs in the leaf certificate. For example a constraint that
>     excludes the subdomain test.example.com does not prevent a leaf certificate from
>     claiming the SAN *.example.com.
>
>     This is CVE-2025-61727 and Go issue https://go.dev/issue/76442.
>
> View the release notes for more information:
> https://go.dev/doc/devel/release#go1.25.5
>
> You can download binary and source distributions from the Go website:
> https://go.dev/dl/
>
> To compile from source using a Git clone, update to the release with
> git checkout go1.25.5 and build as usual.
>
> Thanks to everyone who contributed to the releases.
>
> Cheers,
> Dmitri and Cherry for the Go team


--
        -Alan Coopersmith-                 alan.coopersmith () oracle com
         Oracle Solaris Engineering - https://blogs.oracle.com/solaris