CVE-2015-8618: RSA Computation Vulnerability in math/big Package
Summary
CVE-2015-8618: Incorrect calculation affecting RSA computations in math/big. Affects stdlib versions >= 1.5.0-0, < 1.5.3. Fixed in 1.5.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The math/big package in the Go standard library provides arbitrary-precision arithmetic operations for integers and floating-point numbers. It is commonly used for cryptographic computations, including RSA encryption and decryption. However, a vulnerability in the package's RSA computations can lead to the leakage of private RSA keys, making it easier for attackers to compromise the security of affected systems.
Vulnerability Detail
The vulnerability arises from an incorrect calculation affecting RSA computations in the math/big package. Specifically, the Int.Exp Montgomery function mishandles carry propagation, resulting in an incorrect output. This flaw can be exploited by attackers to obtain private RSA keys through unspecified vectors. RSA computations in the crypto/rsa package, which is used by crypto/tls, are affected by this issue. TLS servers running on 32-bit systems are particularly vulnerable to leaking their RSA private key. Other protocol implementations that heavily rely on RSA signatures may also be impacted. The bug occurs randomly on 32-bit systems, approximately once in every 2^26 times, making it feasible for an attacker to collect enough signatures to extract the private key.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.3
This is the first release that contains the fix.
go get stdlib@v1.5.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by updating the affected Go version.
Conclusion
The vulnerability in the math/big package's RSA computations can lead to the leakage of private RSA keys, posing a significant security risk for affected systems. It is crucial to update the affected Go version to 1.5.3 or later to address this vulnerability. Failure to do so may result in the compromise of sensitive information and the overall security of the system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
TLS servers running on 32-bit systems are particularly vulnerable to leaking their RSA private key due to this issue. Other protocol implementations that heavily rely on RSA signatures may also be impacted.
The bug can be expected to occur randomly on 32-bit systems approximately once in every 2^26 times.
Collecting around 64 million signatures (of known data) from an affected server should be enough to extract the private key used.
While RSA blinding should prevent an attacker from crafting specific inputs to trigger the bug, it does not completely mitigate the vulnerability. The bug can still occur randomly on 32-bit systems.
Yes, on 64-bit systems, the frequency of the bug is significantly lower, making it very difficult to exploit (less than one in 2^50 times).
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
