CVE-2025-58185: Memory Exhaustion Vulnerability in golang Due to Malicious DER Payload Parsing
Summary
CVE-2025-58185: Parsing DER payload can cause memory exhaustion in encoding/asn1. Affects golang across 2 version ranges.
< 1.24.8
>= 1.25.0, < 1.25.2
Fixed in 1.24.8 or 1.25.2, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2025-58185 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Golang, developed by Google, is an open-source programming language designed for simplicity and efficiency in building reliable software. It is widely used for web servers, networking tools, and cloud services. However, a recent vulnerability has been identified in the encoding/asn1 package, which can lead to memory exhaustion when parsing maliciously crafted DER payloads.
Vulnerability Detail
The vulnerability arises from the way the golang encoding/asn1 package processes DER (Distinguished Encoding Rules) payloads. A specially crafted DER payload can cause the application to allocate excessive amounts of memory, potentially leading to memory exhaustion. This can result in denial of service, where the application becomes unresponsive or crashes due to resource depletion. The issue is particularly concerning for applications that handle untrusted input, as it can be exploited by attackers to disrupt service availability.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.24.81.24.8 -
>= 1.25.0, < 1.25.21.25.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can implement input validation to restrict the size and format of DER payloads being processed. This can help mitigate the risk of memory exhaustion by rejecting overly large or malformed inputs before they are parsed.
Conclusion
The CVE-2025-58185 vulnerability in the golang encoding/asn1 package poses a significant risk of memory exhaustion due to malicious DER payloads. It is crucial for developers to update to the patched versions or implement workarounds to safeguard their applications from potential denial of service attacks.
See every vulnerability recorded for golang →
FAQ
CVE-2025-58185 is a vulnerability in the golang encoding/asn1 package that can lead to memory exhaustion when parsing malicious DER payloads.
If your application uses the golang encoding/asn1 package to parse DER payloads, it may be susceptible to denial of service attacks due to memory exhaustion.
The vulnerability affects golang versions prior to 1.24.8 and 1.25.2. Users should upgrade to these versions or later to mitigate the risk.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without any signup.
If an immediate update is not possible, implement input validation to limit the size and format of DER payloads being processed as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
