CVE-2025-22874: Usage of ExtKeyUsageAny disables policy validation in crypto/x509
Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-22874?
CVE-2025-22874 is considered a moderate severity vulnerability due to its impact on policy validation in certain certificate chains.
How do I fix CVE-2025-22874?
To mitigate CVE-2025-22874, update your Google Go version to the latest release that addresses this vulnerability.
What versions of Google Go are affected by CVE-2025-22874?
CVE-2025-22874 affects certain versions of Google Go that use Verify with a VerifyOptions.KeyUsages setting containing ExtKeyUsageAny.
What type of certificates does CVE-2025-22874 affect?
CVE-2025-22874 primarily affects certificate chains that contain policy graphs, which are uncommon.
Is policy validation still functional for certificates not affected by CVE-2025-22874?
Yes, policy validation remains functional for certificates that do not utilize the ExtKeyUsageAny in their configurations.