CVE-2025-22874: Usage of ExtKeyUsageAny disables policy validation in crypto/x509
Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.
Other sources
Usage of ExtKeyUsageAny disables policy validation in crypto/x509
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.24.1-3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.24.4-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.24.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.23.10 - Configuration
Do not set VerifyOptions.KeyUsages to include ExtKeyUsageAny, since it disables policy validation in crypto/x509; instead use specific KeyUsage/ExtKeyUsage values appropriate for the certificates you expect.
Go crypto/x509 (VerifyOptions.KeyUsages) VerifyOptions.KeyUsages includes ExtKeyUsageAny = Do not include ExtKeyUsageAny
Event History
Frequently Asked Questions
What is the severity of CVE-2025-22874?
CVE-2025-22874 is considered a moderate severity vulnerability due to its impact on policy validation in certain certificate chains.
How do I fix CVE-2025-22874?
To mitigate CVE-2025-22874, update your Google Go version to the latest release that addresses this vulnerability.
What versions of Google Go are affected by CVE-2025-22874?
CVE-2025-22874 affects certain versions of Google Go that use Verify with a VerifyOptions.KeyUsages setting containing ExtKeyUsageAny.
What type of certificates does CVE-2025-22874 affect?
CVE-2025-22874 primarily affects certificate chains that contain policy graphs, which are uncommon.
Is policy validation still functional for certificates not affected by CVE-2025-22874?
Yes, policy validation remains functional for certificates that do not utilize the ExtKeyUsageAny in their configurations.