CVE-2025-22865: falha de alta gravidade em Go standard library crypto/x509
ParsePKCS1PrivateKey panic with partial keys in crypto/x509
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.6%
Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is well formed.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
Go standard library · crypto/x509CVEs relacionadas — Go standard library crypto/x509
No mesmo produto, das mais perigosas para as menos.
CVE-2024-24783MEDIUMVerify panics on certificates with an unknown public key algorithm in crypto/x509EPSS 0.7%CVE-2026-27137HIGHIncorrect enforcement of email constraints in crypto/x509EPSS 0.7%CVE-2026-32280HIGHUnexpected work during chain building in crypto/x509EPSS 0.6%CVE-2026-27145MEDIUMInefficient candidate hostname parsing in crypto/x509EPSS 0.6%CVE-2024-45341MEDIUMUsage of IPv6 zone IDs can bypass URI name constraints in crypto/x509EPSS 0.6%CVE-2025-61729HIGHExcessive resource consumption when printing error string for host certificate validation in crypto/x509EPSS 0.5%