CVE-2025-22874: Usage of ExtKeyUsageAny disables policy validation in crypto/x509

Deferred

AliasesUBUNTU-CVE-2025-22874DEBIAN-CVE-2025-22874CGA-223c-mq46-7cpg+3450 more

Published 11-06-2025Last modified 16-06-2025

Vulnerability summary

CVE-2025-22874 is a high (CVSS 7.5) vulnerability in go standard library crypto/x509. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 31.4% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

0.37%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 10 · Related 398

MGASA-2025-0184 OPENSUSE-SU-2025:15224-1 OPENSUSE-SU-2025:15225-1 RHSA-2025:10676 RHSA-2025:10677 RHSA-2026:47712+94 more

Showing 100 of 399.

Timeline

11-06-2025
PublishedVulnerability first disclosed.
16-06-2025
Last modifiedVulnerability information updated.

Description

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

CVSS metrics

5 scores · 5 sources · 1 version

v3.17.5

EPSS trend

Probability

0.37%

Chance of exploitation in the next 30 days

Percentile

31%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.37% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard199 products

addon-resizer< 1.8.23-r6
addon-resizer-compat< 1.8.23-r6
addon-resizer-fips< 1.8.23-r6
addon-resizer-fips-compat< 1.8.23-r6
age< 1.2.1-r5

age-fips< 1.2.1-r5
agentbeat< 9.0.2-r1
agentbeat-fips< 9.0.2-r1
amass< 4.2.0-r24
amazon-cloudwatch-agent< 1.300056.1-r1
amazon-cloudwatch-agent-all< 1.300056.1-r1
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard< 1.300056.1-r1
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fips< 1.300056.1-r1
amazon-cloudwatch-agent-compat< 1.300056.1-r1
amazon-cloudwatch-agent-config-downloader< 1.300056.1-r1
amazon-cloudwatch-agent-config-downloader-fips< 1.300056.1-r1
amazon-cloudwatch-agent-config-translator< 1.300056.1-r1
amazon-cloudwatch-agent-config-translator-fips< 1.300056.1-r1
amazon-cloudwatch-agent-fips< 1.300056.1-r1
amazon-cloudwatch-agent-operator-fips< 3.0.1-r1
amazon-cloudwatch-agent-operator-fips-compat< 3.0.1-r1
amazon-cloudwatch-agent-start-amazon-cloudwatch-agent< 1.300056.1-r1
amazon-cloudwatch-agent-start-amazon-cloudwatch-agent-fips< 1.300056.1-r1
amazon-k8s-cni< 1.19.5-r1
amazon-k8s-cni-compat< 1.19.5-r1
amazon-k8s-cni-init< 1.19.5-r1
amazon-k8s-cni-init-compat< 1.19.5-r1
amazon-ssm-agent< 3.3.2656.0-r1
amazon-ssm-agent-ecs-exec< 3.3.2656.0-r1
amazon-ssm-agent-ecs-exec-fips< 3.3.2656.0-r1
amazon-ssm-agent-fips< 3.3.2656.0-r1
apache-beam-java-11-sdk< 2.65.0-r2
apache-beam-java-17-sdk< 2.65.0-r2
apache-beam-java-21-sdk< 2.65.0-r2
apache-beam-java-sdk< 2.65.0-r2
apko< 0.27.9-r1
apko-fips< 0.27.9-r1
auditbeat-7< 7.17.28-r14
auditbeat-7-oci-entrypoint< 7.17.28-r14
auditbeat-fips-7< 7.17.28-r14
authservice< 1.0.4-r8
authservice-compat< 1.0.4-r8
authservice-fips< 1.0.4-r8
authservice-fips-compat< 1.0.4-r8
aws-application-networking-k8s< 1.1.2-r0
aws-application-networking-k8s-compat< 1.1.2-r0
aws-application-networking-k8s-fips< 1.1.2-r15
aws-application-networking-k8s-fips-compat< 1.1.2-r15
aws-ebs-csi-driver< 1.44.0-r1
aws-efs-csi-driver< 2.1.8-r3
aws-efs-csi-driver-fips< 2.1.8-r2
aws-eks-pod-identity-agent< 0.1.30-r1
aws-eks-pod-identity-agent-compat< 0.1.30-r1
aws-eks-pod-identity-agent-fips< 0.1.30-r1
aws-flb-cloudwatch< 1.9.4-r17
aws-flb-cloudwatch-compat< 1.9.4-r17
aws-flb-cloudwatch-compat-fips< 1.9.4-r11
aws-flb-cloudwatch-fips< 1.9.4-r11
aws-flb-firehose< 1.7.2-r17
aws-flb-firehose-compat< 1.7.2-r17
aws-flb-firehose-compat-fips< 1.7.2-r11
aws-flb-firehose-fips< 1.7.2-r11
aws-flb-kinesis< 1.10.2-r18
aws-flb-kinesis-compat< 1.10.2-r18
aws-flb-kinesis-compat-fips< 1.10.2-r12
aws-flb-kinesis-fips< 1.10.2-r12
aws-iam-authenticator< 0.7.2-r1
aws-load-balancer-controller< 2.13.2-r2
aws-load-balancer-controller-compat< 2.13.2-r2
aws-load-balancer-controller-fips< 2.13.2-r2
aws-network-policy-agent-compat-fips< 1.2.1-r2
aws-network-policy-agent-fips< 1.2.1-r2
aws-privateca-issuer< 1.6.0-r1
aws-privateca-issuer-compat< 1.6.0-r1
aws-privateca-issuer-compat-fips< 1.6.0-r1
aws-privateca-issuer-fips< 1.6.0-r1
azcopy< 10.29.1-r1
azcopy-fips< 10.29.1-r1
azure-aad-pod-identity-mic< 1.8.17-r24
azure-aad-pod-identity-nmi< 1.8.17-r24
azure-container-networking< 1.6.25-r2
azure-service-operator< 2.13.0-r3
azure-service-operator-compat< 2.13.0-r3
azure-service-operator-fips< 2.13.0-r2
azure-vnet-cni< 1.6.25-r2
azure-workload-identity-webhook< 1.5.1-r0
azure-workload-identity-webhook-compat< 1.5.1-r0
azuredisk-csi-1.28< 1.28.12-r3
azuredisk-csi-1.28-compat< 1.28.12-r3
azuredisk-csi-1.29< 1.29.14-r3
azuredisk-csi-1.29-compat< 1.29.14-r3
azuredisk-csi-1.30< 1.30.12-r1
azuredisk-csi-1.30-compat< 1.30.12-r1
azuredisk-csi-fips-1.28< 1.28.12-r3
azuredisk-csi-fips-1.29< 1.29.14-r3
azuredisk-csi-fips-1.30< 1.30.12-r1
azuredisk-csi-fips-1.32< 1.32.7-r1
azuredisk-csi-fips-1.33< 1.33.1-r1
bank-vaults< 1.20.4-r31
bank-vaults-fips< 1.20.4-r28
bank-vaults-template< 1.20.4-r31
bank-vaults-template-fips< 1.20.4-r28
bazelisk< 1.26.0-r1
bazelisk-default< 1.26.0-r1
beats-7< 7.17.28-r14
beats-fips-7< 7.17.28-r14
blob-csi-1.23< 1.23.11-r3
blob-csi-1.23-compat< 1.23.11-r3
blob-csi-1.24< 1.24.10-r1
blob-csi-1.24-compat< 1.24.10-r1
blob-csi-1.26< 1.26.5-r1
blob-csi-1.26-compat< 1.26.5-r1
blob-csi-fips-1.23< 1.23.11-r3
blob-csi-fips-1.23-compat< 1.23.11-r3
blob-csi-fips-1.24< 1.24.10-r1
blob-csi-fips-1.24-compat< 1.24.10-r1
blob-csi-fips-1.25< 1.25.8-r1
blob-csi-fips-1.25-compat< 1.25.8-r1
blob-csi-fips-1.26< 1.26.5-r1
blob-csi-fips-1.26-compat< 1.26.5-r1
blobfuse2< 2.4.2-r2
blobfuse2-fips< 2.4.2-r1
blobfuse2-fips-health-monitor< 2.4.2-r1
blobfuse2-fips-syslog< 2.4.2-r1
blobfuse2-health-monitor< 2.4.2-r2
blobfuse2-syslog< 2.4.2-r2
bom< 0.6.0-r21
boring-registry< 0.16.4-r1
boring-registry-fips< 0.16.4-r1
buf< 1.54.0-r1
buildctl< 0.22.0-r1
buildctl-fips< 0.22.0-r1
buildkitd< 0.22.0-r1
buildkitd-fips< 0.22.0-r1
cadvisor-fips< 0.53.0-r1
calico-3.29< 3.29.4-r1
calico-3.30< 3.30.1-r1
calico-apiserver-3.29< 3.29.4-r1
calico-apiserver-3.30< 3.30.1-r1
calico-apiserver-compat-3.29< 3.29.4-r1
calico-apiserver-compat-3.30< 3.30.1-r1
calico-app-policy-3.29< 3.29.4-r1
calico-app-policy-3.30< 3.30.1-r1
calico-cni-3.29< 3.29.4-r1
calico-cni-3.30< 3.30.1-r1
calico-cni-compat-3.29< 3.29.4-r1
calico-cni-compat-3.30< 3.30.1-r1
calico-felix-3.29< 3.29.4-r1
calico-felix-3.30< 3.30.1-r1
calico-goldmane-3.30< 3.30.1-r1
calico-key-cert-provisioner-3.29< 3.29.4-r1
calico-key-cert-provisioner-3.30< 3.30.1-r1
calico-kube-controllers-3.29< 3.29.4-r1
calico-kube-controllers-3.30< 3.30.1-r1
calico-node-3.29< 3.29.4-r1
calico-node-3.30< 3.30.1-r1
calico-pod2daemon-3.29< 3.29.4-r1
calico-pod2daemon-3.30< 3.30.1-r1
calico-pod2daemon-flexvol-compat-3.29< 3.29.4-r1
calico-pod2daemon-flexvol-compat-3.30< 3.30.1-r1
calico-typha-client-3.29< 3.29.4-r1
calico-typha-client-3.30< 3.30.1-r1
calico-typhad-3.29< 3.29.4-r1
calico-typhad-3.30< 3.30.1-r1
calico-whisker-3.30< 3.30.1-r1
calico-whisker-backend-3.30< 3.30.1-r1
calicoctl-3.29< 3.29.4-r1
calicoctl-3.30< 3.30.1-r1
capslock< 0.2.7-r4
cargobump< 0.1.0-r4
cass-operator< 1.24.0-r2
cass-operator-compat< 1.24.0-r2
cass-operator-compat-fips< 1.24.0-r1
cass-operator-config< 1.24.0-r2
cass-operator-fips< 1.24.0-r1
cass-operator-fips-no-pvc-delete< 1.24.0-r1
cass-operator-fips-no-pvc-delete-compat< 1.24.0-r1
cert-manager-cmctl< 2.2.0-r1
cert-manager-cmctl-fips< 2.2.0-r1
cert-manager-fips-1.17< 1.17.2-r2
cert-manager-istio-csr< 0.14.1-r1
cert-manager-istio-csr-compat< 0.14.1-r1
cert-manager-webhook-pdns< 2.5.2-r7
cert-manager-webhook-pdns-fips< 2.5.2-r7
cfssl< 1.6.5-r20
cfssl-bundle< 1.6.5-r20
cfssl-bundle-fips< 1.6.5-r12
cfssl-certinfo< 1.6.5-r20
cfssl-certinfo-fips< 1.6.5-r12
cfssl-fips< 1.6.5-r12
cfssl-json< 1.6.5-r20
cfssl-json-fips< 1.6.5-r12
cfssl-mkbundle< 1.6.5-r20
cfssl-mkbundle-fips< 1.6.5-r12
cfssl-multirootca< 1.6.5-r20
cfssl-multirootca-fips< 1.6.5-r12
cfssl-newkey< 1.6.5-r20
cfssl-newkey-fips< 1.6.5-r12
cfssl-scan< 1.6.5-r20

Show all 199

Alpine1 product

go< 1.24.4-r0

2 vendors · 200 products · Showing 200 of 2477

References

10 links

go.dev/cl/670375FIX
go.dev/issue/73612REPORT
groups.google.com/g/golang-announce/c/ufZ8WpEsA3AWEB
pkg.go.dev/vuln/GO-2025-3749
ubuntu.com/security/CVE-2025-22874REPORT
www.cve.org/CVERecord?id=CVE-2025-22874REPORT
security-tracker.debian.org/tracker/CVE-2025-22874Advisory
www.suse.com/security/cve/CVE-2025-22874WEB
nvd.nist.gov/vuln/detail/CVE-2025-22874OvalAdvisory
security.alpinelinux.org/vuln/CVE-2025-22874Advisory