VYPR
← All advisories
High severity7.5NVD Advisory· Published Jun 11, 2025· Updated Apr 15, 2026

CVE-2025-22874

CVE-2025-22874

Description

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Using ExtKeyUsageAny in Go's crypto/x509 Verify() disables policy validation, potentially allowing invalid certificate chains to be accepted.

A vulnerability in Go's crypto/x509 package (CVE-2025-22874) causes policy validation to be unintentionally disabled when the VerifyOptions.KeyUsages field contains ExtKeyUsageAny. The root cause is that the implementation incorrectly treats the presence of ExtKeyUsageAny as a signal to skip policy checks, even though these two properties are unrelated [1][3].

Exploitation requires an attacker to craft a certificate chain that includes policy graphs—a relatively uncommon feature—and the verifier must explicitly set ExtKeyUsageAny in the verification options. This combination makes the attack surface narrow, but it is still possible in environments that rely on policy constraints [3].

If successfully exploited, an attacker could bypass policy validation, potentially causing a certificate chain that violates policy constraints to be accepted as valid. This could undermine trust in certificate-based authentication in affected applications [1].

The issue is fixed in Go 1.24.4 and Go 1.23.10. Users are advised to update to these versions or later to mitigate the vulnerability [1][3].

References
  1. [security] Go 1.24.4 and Go 1.23.10 are released
  2. crypto/x509: ExtKeyUsageAny bypasses policy validation

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

3619

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

4

News mentions

0

No linked articles in our index yet.