GO-2025-3749

vendorUSosv

Usage of ExtKeyUsageAny disables policy validation in crypto/x509

view advisory published 2025-06-11Licence: per source

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-22874US	—	0.37% (31st)	—	2025-06-11
Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy gra…

references

External citations — patches, advisories, analysis.

https://go.dev/cl/670375FIX
https://go.dev/issue/73612REPORT
https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3AWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan