CVE-2025-58188: Panic when validating certificates with DSA public keys in crypto/x509

Analyzed

AliasesUBUNTU-CVE-2025-58188DEBIAN-CVE-2025-58188CGA-22r3-g537-6cff+3953 more

Published 29-10-2025Last modified 04-11-2025

Vulnerability summary

CVE-2025-58188 is a high (CVSS 7.5) Improper Certificate Validation vulnerability in go standard library crypto/x509. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 32.2% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

0.38%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 22 · Related 88

MGASA-2025-0256 OPENSUSE-SU-2025:15608-1 OPENSUSE-SU-2025:15609-1 OPENSUSE-SU-2025:15695-1 OPENSUSE-SU-2025:15723-1 OPENSUSE-SU-2025:20157-1+85 more

Timeline

29-10-2025
PublishedVulnerability first disclosed.
04-11-2025
Last modifiedVulnerability information updated.

Description

Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains.

CVSS metrics

7 scores · 7 sources · 1 version

v3.17.5

EPSS trend

Probability

0.38%

Chance of exploitation in the next 30 days

Percentile

32%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.38% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-295Improper Certificate ValidationThe product does not validate, or incorrectly validates, a certificate.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard199 products

age< 1.2.1-r8
age-fips< 1.2.1-r8
amass< 5.0.1-r1
amazon-k8s-cni-fips< 1.20.4-r2
amazon-k8s-cni-init-fips< 1.20.4-r2

amazon-k8s-cni-init-fips-compat< 1.20.4-r2
ansible-operator< 1.41.0-r1
ansible-operator-compat< 1.41.0-r1
apisix-ingress-controller< 1.8.4-r4
apisix-ingress-controller-compat< 1.8.4-r4
apisix-ingress-controller-iamguarded-compat< 1.8.4-r4
apm-server-7.17< 7.17.29-r4
apm-server-7.17-compat< 7.17.29-r4
apm-server-8.17< 8.17.10-r2
apm-server-8.17-compat< 8.17.10-r2
apm-server-8.18< 8.18.8-r1
apm-server-8.18-compat< 8.18.8-r1
apm-server-fips-7.17< 7.17.29-r4
apm-server-fips-7.17-compat< 7.17.29-r4
apm-server-fips-8.17< 8.17.10-r1
apm-server-fips-8.17-compat< 8.17.10-r1
apm-server-fips-8.18< 8.18.8-r1
apm-server-fips-8.18-compat< 8.18.8-r1
apm-server-fips-9.0< 9.0.8-r1
apm-server-fips-9.0-compat< 9.0.8-r1
argo-cd-2.13-compat< 2.13.9-r2
argo-rollouts< 1.8.3-r4
argo-rollouts-fips< 1.8.3-r5
atlantis< 0.36.0-r2
auditbeat-fips-8.17< 8.17.10-r2
auditbeat-fips-8.18< 8.18.8-r2
auditbeat-fips-9.0< 9.0.8-r2
authservice-fips< 1.1.1-r1
authservice-fips-compat< 1.1.1-r1
aws-iam-authenticator< 0.7.8-r1
aws-iam-authenticator-fips< 0.7.8-r1
aws-node-termination-handler< 1.25.2-r2
aws-node-termination-handler-compat< 1.25.2-r2
aws-node-termination-handler-fips< 1.25.2-r2
aws-node-termination-handler-fips-compat< 1.25.2-r2
aws-privateca-issuer-compat-fips< 1.7.0-r3
aws-privateca-issuer-fips< 1.7.0-r3
aws-s3-controller< 1.1.1-r1
aws-signer-notation-plugin< 1.0.2292-r3
aws-signer-notation-plugin-fips< 1.0.2292-r3
aws-sigv4-proxy< 1.10-r3
aws-sigv4-proxy-compat< 1.10-r3
aws-sigv4-proxy-fips< 1.10-r3
aws-sigv4-proxy-fips-compat< 1.10-r3
azure-aad-pod-identity-mic< 1.8.17-r28
azure-aad-pod-identity-nmi< 1.8.17-r28
azure-container-networking< 1.7.4-r1
azure-ipam< 0.4.0-r4
azure-ipam-dropgz< 0.4.0-r4
azure-vnet-cni< 1.7.4-r1
azure-workload-identity-webhook< 1.5.1-r3
azure-workload-identity-webhook-compat< 1.5.1-r3
azuredisk-csi-fips-1.33< 1.33.5-r1
azurefile-csi-1.30< 1.30.10-r5
azurefile-csi-1.30-compat< 1.30.10-r5
azurefile-csi-1.31< 1.31.8-r1
azurefile-csi-1.31-compat< 1.31.8-r1
azurefile-csi-1.32< 1.32.7-r1
azurefile-csi-1.32-compat< 1.32.7-r1
azurefile-csi-1.33< 1.33.5-r1
azurefile-csi-1.33-compat< 1.33.5-r1
azurefile-csi-fips-1.29< 1.29.12-r5
azurefile-csi-fips-1.29-compat< 1.29.12-r5
azurefile-csi-fips-1.30< 1.30.10-r5
azurefile-csi-fips-1.30-compat< 1.30.10-r5
azurefile-csi-fips-1.31< 1.31.8-r1
azurefile-csi-fips-1.31-compat< 1.31.8-r1
azurefile-csi-fips-1.32< 1.32.7-r1
azurefile-csi-fips-1.32-compat< 1.32.7-r1
bazelisk< 1.27.0-r1
bazelisk-default< 1.27.0-r1
beats-fips-8.17< 8.17.10-r2
beats-fips-8.18< 8.18.8-r2
beats-fips-9.0< 9.0.8-r2
blob-csi-1.23< 1.23.11-r56
blob-csi-1.23-compat< 1.23.11-r56
blob-csi-1.24< 1.24.11-r5
blob-csi-1.24-compat< 1.24.11-r5
blob-csi-1.25< 1.25.10-r1
blob-csi-1.25-compat< 1.25.10-r1
blob-csi-fips-1.23< 1.23.11-r57
blob-csi-fips-1.23-compat< 1.23.11-r57
blob-csi-fips-1.24< 1.24.11-r5
blob-csi-fips-1.24-compat< 1.24.11-r5
blob-csi-fips-1.25< 1.25.10-r1
blob-csi-fips-1.25-compat< 1.25.10-r1
blob-csi-fips-1.26< 1.26.7-r3
blob-csi-fips-1.26-compat< 1.26.7-r3
blobfuse2-fips< 2.4.2-r6
blobfuse2-fips-health-monitor< 2.4.2-r6
blobfuse2-fips-syslog< 2.4.2-r6
bom< 0.7.1-r1
boring-registry< 0.16.6-r2
boring-registry-fips< 0.16.6-r2
cadvisor< 0.53.0-r6
cadvisor-compat< 0.53.0-r6
calico-3.29< 3.29.6-r1
calico-apiserver-3.29< 3.29.6-r1
calico-apiserver-compat-3.29< 3.29.6-r1
calico-app-policy-3.29< 3.29.6-r1
calico-cni-3.29< 3.29.6-r1
calico-cni-compat-3.29< 3.29.6-r1
calico-felix-3.29< 3.29.6-r1
calico-key-cert-provisioner-3.29< 3.29.6-r1
calico-kube-controllers-3.29< 3.29.6-r1
calico-node-3.29< 3.29.6-r1
calico-pod2daemon-3.29< 3.29.6-r1
calico-pod2daemon-flexvol-compat-3.29< 3.29.6-r1
calico-typha-client-3.29< 3.29.6-r1
calico-typhad-3.29< 3.29.6-r1
calicoctl-3.29< 3.29.6-r1
capslock< 0.2.8-r1
cargobump< 0.1.0-r7
cephcsi-fips< 3.15.0-r3
cert-exporter< 2.16.0-r2
cert-exporter-fips< 2.16.0-r3
cert-manager-cmctl< 2.3.0-r5
cert-manager-webhook-pdns< 2.5.3-r1
cert-manager-webhook-pdns-fips< 2.5.3-r2
certificate-transparency< 1.3.2-r4
certificate-transparency-trillian-ctserver< 1.3.2-r4
cfssl< 1.6.5-r23
cfssl-bundle< 1.6.5-r23
cfssl-bundle-fips< 1.6.5-r16
cfssl-certinfo< 1.6.5-r23
cfssl-certinfo-fips< 1.6.5-r16
cfssl-fips< 1.6.5-r16
cfssl-json< 1.6.5-r23
cfssl-json-fips< 1.6.5-r16
cfssl-mkbundle< 1.6.5-r23
cfssl-mkbundle-fips< 1.6.5-r16
cfssl-multirootca< 1.6.5-r23
cfssl-multirootca-fips< 1.6.5-r16
cfssl-newkey< 1.6.5-r23
cfssl-newkey-fips< 1.6.5-r16
cfssl-scan< 1.6.5-r23
cfssl-scan-fips< 1.6.5-r16
chartmuseum< 0.16.3-r8
chartmuseum-fips< 0.16.3-r6
checksec< 3.0.2-r6
chisel< 1.11.3-r1
chisel-compat< 1.11.3-r1
chisel-fips< 1.11.3-r1
cilium-1.15< 1.15.19-r3
cilium-1.15-clustermesh-apiserver< 1.15.19-r3
cilium-1.15-container-init< 1.15.19-r3
cilium-1.15-container-init-compat< 1.15.19-r3
cilium-1.15-hubble-relay< 1.15.19-r3
cilium-1.15-iptables< 1.15.19-r3
cilium-1.15-operator-aws< 1.15.19-r3
cilium-1.15-operator-generic< 1.15.19-r3
cilium-certgen-0.2< 0.2.4-r3
cilium-envoy-fips-1.15< 1.15.19-r6
cilium-fips-1.15< 1.15.19-r7
cilium-fips-1.15-clustermesh-apiserver< 1.15.19-r7
cilium-fips-1.15-container-init< 1.15.19-r7
cilium-fips-1.15-container-init-compat< 1.15.19-r7
cilium-fips-1.15-host-utils< 1.15.19-r7
cilium-fips-1.15-hubble-relay< 1.15.19-r7
cilium-fips-1.15-operator-aws< 1.15.19-r7
cilium-fips-1.15-operator-azure< 1.15.19-r7
cilium-fips-1.15-operator-generic< 1.15.19-r7
cis-operator-1.2< 1.2.7-r5
cloud-provider-aws-1.28< 1.28.11-r40
cloud-provider-aws-1.28-cloud-controller-manager< 1.28.11-r40
cloud-provider-aws-1.28-ecr-credential-provider< 1.28.11-r40
cloud-provider-aws-1.29< 1.29.8-r40
cloud-provider-aws-1.29-cloud-controller-manager< 1.29.8-r40
cloud-provider-aws-1.29-ecr-credential-provider< 1.29.8-r40
cloud-provider-aws-fips-1.28< 1.28.11-r11
cloud-provider-aws-fips-1.28-cloud-controller-manager< 1.28.11-r11
cloud-provider-aws-fips-1.28-ecr-credential-provider< 1.28.11-r11
cloud-provider-aws-fips-1.29< 1.29.8-r11
cloud-provider-aws-fips-1.29-cloud-controller-manager< 1.29.8-r11
cloud-provider-aws-fips-1.29-ecr-credential-provider< 1.29.8-r11
cloud-provider-azure-1.27< 1.27.21-r15
cloud-provider-azure-1.28< 1.28.14-r11
cloud-provider-azure-1.29< 1.29.15-r5
cloud-provider-azure-1.30< 1.30.15-r1
cloud-provider-azure-1.31< 1.31.9-r1
cloud-provider-azure-1.33< 1.33.3-r1
cloud-provider-azure-cloud-controller-manager-1.27< 1.27.21-r15
cloud-provider-azure-cloud-controller-manager-1.27-compat< 1.27.21-r15
cloud-provider-azure-cloud-controller-manager-1.28< 1.28.14-r11
cloud-provider-azure-cloud-controller-manager-1.28-compat< 1.28.14-r11
cloud-provider-azure-cloud-controller-manager-1.29< 1.29.15-r5
cloud-provider-azure-cloud-controller-manager-1.29-compat< 1.29.15-r5
cloud-provider-azure-cloud-controller-manager-1.30< 1.30.15-r1
cloud-provider-azure-cloud-controller-manager-1.30-compat< 1.30.15-r1
cloud-provider-azure-cloud-controller-manager-1.31< 1.31.9-r1
cloud-provider-azure-cloud-controller-manager-1.31-compat< 1.31.9-r1
cloud-provider-azure-cloud-controller-manager-1.33< 1.33.3-r1
cloud-provider-azure-cloud-controller-manager-1.33-compat< 1.33.3-r1
cloud-provider-azure-cloud-controller-manager-fips-1.27< 1.27.21-r14

Show all 199

Alpine1 product

go≥ 1.25.0, < 1.24.8-r0 | ≥ 1.25.0, < 1.25.2-r0

2 vendors · 200 products · Showing 200 of 2325

References

17 links

go.dev/cl/709853WEBFIXPatch
go.dev/issue/75675WEBREPORTIssue Tracking
groups.google.com/g/golang-announce/c/4Emdl2iQ_bIWEBMailing ListRelease Notes
pkg.go.dev/vuln/GO-2025-4013WEBVendor Advisory
www.openwall.com/lists/oss-security/2025/10/08/1WEBMailing ListRelease Notes
ubuntu.com/security/CVE-2025-58188REPORT
www.cve.org/CVERecord?id=CVE-2025-58188REPORT
groups.google.com/g/golang-announce/c/4Emdl2iQ_bI/m/qZN5nc-mBgAJREPORT
github.com/golang/go/issues/75675REPORT
github.com/golang/go/commit/930ce220d052d632f0d84df5850c812a77b70175REPORT

Show all 17 references