CVE-2025-22865 Details
Description
Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is well formed.
A vulnerability exists in the Go programming language's crypto/x509 package, specifically in the ParsePKCS1PrivateKey function. This issue arises when parsing RSA private keys that lack the Chinese Remainder Theorem (CRT) values, leading to a panic during the key validation process. The vulnerability is present in Go version 1.24 release candidates prior to 1.24.0-rc.2.
Users can upgrade to Go 1.24.0-rc.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jan 28, 2025CISA-ADP
Assessed Jan 28, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://go.dev/cl/643098 | [email protected] | Source CodeVendor |
| https://go.dev/issue/71216 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ | [email protected] | Mailing ListBundleRemedyVendor |
| https://pkg.go.dev/vuln/GO-2025-3421 | [email protected] | AdvisoryBundleVendor |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| golang.org crypto/x509 | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 28, 2025 | CVE Modified | CISA-ADP |
| Jan 28, 2025 | New CVE Received | [email protected] |