CVE-2020-14039: Certificate verification error on Windows in crypto/x509
Summary
CVE-2020-14039: Certificate verification error on Windows in crypto/x509. Affects stdlib across 2 version ranges.
< 1.13.13
>= 1.14.0-0, < 1.14.5
Fixed in 1.13.13 or 1.14.5, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
The same CVE-2020-14039 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The stdlib package in the Go ecosystem provides a collection of standard libraries for the Go programming language. The crypto/x509 package within stdlib is responsible for handling X.509 certificates. X.509 is a standard format for public key certificates, commonly used for secure communication over the internet. This vulnerability affects the Windows operating system when using the Certificate.Verify function with nil VerifyOptions.Roots. It allows a certificate to be used for unintended purposes by bypassing the Extended Key Usage (EKU) requirements specified in VerifyOptions.KeyUsages.
Vulnerability Detail
The vulnerability arises from a flaw in the Certificate.Verify function in the crypto/x509 package on Windows. When VerifyOptions.Roots is set to nil, the function fails to check the EKU requirements specified in VerifyOptions.KeyUsages. This oversight enables a certificate to be used for unintended purposes, potentially leading to security breaches or unauthorized access. It is important to note that this vulnerability is specific to the Windows operating system.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.13.131.13.13go get stdlib@v1.13.13 -
>= 1.14.0-0, < 1.14.51.14.5go get stdlib@v1.14.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, you can explicitly set VerifyOptions.Roots to a non-nil value when calling the Certificate.Verify function. By providing a valid root certificate pool, the EKU requirements specified in VerifyOptions.KeyUsages will be properly checked. Here is an example of how to set VerifyOptions.Roots:
certPool := x509.NewCertPool()
// Add root certificates to the certPool
verifyOpts := x509.VerifyOptions{
Roots: certPool,
KeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
}
// Call Certificate.Verify with verifyOpts
err := cert.Verify(verifyOpts)
Conclusion
In conclusion, the CVE-2020-14039 vulnerability in the crypto/x509 package of the Go stdlib on Windows allows a certificate to be used for unintended purposes. To mitigate this vulnerability, it is crucial to update the affected Go package to a version that includes the fix. Regularly updating your Go packages is recommended to ensure you have the latest security patches. If you need further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
This vulnerability allows a certificate to be used for unintended purposes, potentially leading to security breaches or unauthorized access.
The vulnerability affects versions 0.0.0 to 1.13.12 and 1.14.0 to 1.14.4 of the Go stdlib package.
Yes, this vulnerability is specific to the Windows operating system.
There are no known exploits for this vulnerability at the time of this report.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your Gopkg.lock file and Vulert will analyze it for open-source vulnerabilities, including this one.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
