CVE-2025-22874: Go Standard Library - ExtKeyUsageAny Disables Policy Validation in crypto/x509
Summary
CVE-2025-22874: Usage of ExtKeyUsageAny disables policy validation in crypto/x509. Affects stdlib versions >= 1.24.0-0, < 1.24.4. Fixed in 1.24.4. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.24 · Debian:13
The same CVE-2025-22874 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Go standard library is a collection of packages that provide essential functionality for Go applications, including cryptography, networking, and data manipulation. The crypto/x509 package specifically deals with X.509 certificates, which are widely used for secure communications over the internet. This package allows developers to verify the authenticity of certificates, ensuring secure connections. However, a recent vulnerability has been identified that affects the policy validation process when using certain key usages.
Vulnerability Detail
The vulnerability arises from the use of ExtKeyUsageAny in the VerifyOptions.KeyUsages parameter when calling the Verify method in the crypto/x509 package. This setting unintentionally disables policy validation for certificate chains that contain policy graphs, which are not commonly encountered. As a result, an attacker could exploit this oversight to bypass security checks, potentially leading to unauthorized access or man-in-the-middle attacks.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.24.4
This is the first release that contains the fix.
go get stdlib@v1.24.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using ExtKeyUsageAny in your VerifyOptions.KeyUsages when verifying certificates. Instead, specify the exact key usages required for your application to maintain policy validation.
Conclusion
The vulnerability identified as CVE-2025-22874 in the Go standard library's crypto/x509 package poses a significant risk by disabling policy validation when ExtKeyUsageAny is used. It is crucial for developers to update to the patched versions to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for stdlib →
FAQ
ExtKeyUsageAny is a key usage extension that allows a certificate to be used for any purpose. However, its use can lead to security vulnerabilities if not handled correctly.
If your application relies on the crypto/x509 package for certificate validation and uses ExtKeyUsageAny, it may be susceptible to bypassing security checks, which could lead to unauthorized access.
If you cannot update immediately, ensure to avoid using ExtKeyUsageAny in your certificate validation logic as a temporary measure.
You can use Vulert, which monitors and alerts for open-source vulnerabilities. By uploading your Gopkg.lock file, you can check for vulnerabilities in real-time without needing to install any software.
Detailed information about this vulnerability can be found in the Go vulnerability database at https://pkg.go.dev/vuln/GO-2025-3749.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
