CVE-2025-22874 — Improper Certificate Validation in Standard Library Crypto X509

CWE-295 — Improper Certificate Validation8 documents7 sources
Severity
7.5HIGHNVD
EPSS
0.1%
top 77.25%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
GO Standard Library Crypto X509
Timeline
PublishedJun 11

Description

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

▶CVEListV5go_standard_library/crypto_x5091.24.0-0 — 1.24.4

🔴Vulnerability Details

4
CVEList
Usage of ExtKeyUsageAny disables policy validation in crypto/x509↗2025-06-11
▶
GHSA
GHSA-6f52-wpx2-hvf2: Calling Verify with a VerifyOptions↗2025-06-11
▶
OSV
CVE-2025-22874: Calling Verify with a VerifyOptions↗2025-06-11
▶
OSV
Usage of ExtKeyUsageAny disables policy validation in crypto/x509↗2025-06-11
▶

📋Vendor Advisories

3
Red Hat
crypto/x509: Usage of ExtKeyUsageAny disables policy validation in crypto/x509↗2025-06-11
▶
Microsoft
Usage of ExtKeyUsageAny disables policy validation in crypto/x509↗2025-06-10
▶
Debian
CVE-2025-22874: golang-1.15 - Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unint...↗2025
▶
CVE-2025-22874 — Improper Certificate Validation | cvebase