Interface Casting Flaw in Certificate Chain Validation for Go Programming Language
CVE-2025-58188

7.5HIGH

Key Information:

Vendor

Go Standard Library

Status
Crypto/x509
Vendor
CVE Published:
29 October 2025

What is CVE-2025-58188?

A flaw in the Go programming language can cause programs to panic when validating certificate chains that include DSA public keys. The issue stems from an interface casting assumption that these keys properly implement the Equal method. If such assumptions are not met, it can lead to unexpected behaviors during the validation of arbitrary certificate chains, potentially impacting application stability.

Affected Version(s)

crypto/x509 0 < 1.24.8

crypto/x509 1.25.0 < 1.25.2

References

https://go.dev/cl/709853
https://go.dev/issue/75675
https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jakub Ciolek
JSON
.