archive/zip used a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.

Thanks to Thanks to Jakub Ciolek for reporting this issue.

This is CVE-2025-61728 and Go issue https://go.dev/issue/77102.

This is a PRIVATE issue for CVE-2025-61728, tracked in http://b/445533267 and fixed by https://go-internal-review.git.corp.google.com/c/go/+/3060.

/cc @golang/security and @golang/release