CVE-2025-58188: Panic when validating certificates with DSA public keys in crypto/x509
Panic when validating certificates with DSA public keys in crypto/x509
Other sources
Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.2.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-58188?
CVE-2025-58188 has a severity level that indicates it may lead to application crashes when validating DSA public keys.
What causes the CVE-2025-58188 vulnerability?
The CVE-2025-58188 vulnerability is caused by an interface cast that incorrectly assumes DSA public keys implement the Equal method, leading to program panic.
How do I fix CVE-2025-58188?
To fix CVE-2025-58188, update your affected software to the latest version that resolves this certificate validation issue.
Which software products are affected by CVE-2025-58188?
CVE-2025-58188 affects several Microsoft software products including TensorFlow, GCC, and Golang in specific versions.
What are the potential impacts of CVE-2025-58188?
The potential impacts of CVE-2025-58188 include application crashes and disruptions in services that rely on valid DSA public key certificate validation.