Secret Scalar Leakage in Golang on PPC64LE Architecture
Summary
CVE-2025-22866: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec. Affects golang across 3 version ranges.
< 1.22.12
>= 1.23.0-0, < 1.23.6
>= 1.24.0-0, < 1.24.0
Fixed in 1.22.12, 1.23.6 or 1.24.0, depending on the release line you run. How to fix ↓
Also tracked for
- golang-1.15 · Debian:11
- stdlib · Go
The same CVE-2025-22866 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Golang, also known as Go, is an open-source programming language designed for simplicity and efficiency in software development. It is widely used for building web servers, data pipelines, and other applications. The vulnerability in question affects the assembly implementation of an internal function within Golang, specifically on the ppc64le architecture, which may lead to the leakage of secret scalar bits.
Vulnerability Detail
The vulnerability arises from the use of a variable time instruction in the assembly code of an internal function. This implementation flaw can leak a small number of bits from secret scalars when the P-256 elliptic curve is used. While the leakage is not believed to be sufficient for private key recovery in well-known protocols, it poses a potential risk that should not be overlooked. The affected versions of Golang include those prior to 1.22.12, and between 1.23.0-0 and 1.23.6, as well as 1.24.0-0 up to 1.24.0-rc.3.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.22.121.22.12 -
>= 1.23.0-0, < 1.23.61.23.6 -
>= 1.24.0-0, < 1.24.01.24.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched versions as indicated.
Conclusion
In summary, the vulnerability in Golang related to secret scalar leakage on the ppc64le architecture poses a potential risk, although it is not sufficient for private key recovery in most scenarios. Users are encouraged to update to the latest patched versions to ensure their applications remain secure.
See every vulnerability recorded for golang →
FAQ
The vulnerability involves the leakage of secret scalar bits due to variable time instructions in the assembly implementation of an internal function.
Versions prior to 1.22.12, between 1.23.0-0 and 1.23.6, and 1.24.0-0 up to 1.24.0-rc.3 are affected.
No, the leakage is not believed to be enough to allow recovery of the private key when using P-256 in well-known protocols.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground at Vulert Scanner without any signup.
While there are no specific workarounds, it is advisable to prioritize updating to a patched version as soon as possible to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
