CVE-2025-22865

Description

Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is well formed.

Affected packages (3)

• Bitnami/golang>= 1.24.0-0, < 1.24.0-rc.2
• Debian/golang-1.24from 0, < 1.24~rc2-1
• Go/stdlib>= 1.24.0-0, < 1.24.0-rc.2

CVSS scores

References (5)

• ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2025-22865
• PATCHhttps://go.dev/cl/643098
• REPORThttps://go.dev/issue/71216
• WEBhttps://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ
• WEBhttps://pkg.go.dev/vuln/GO-2025-3421