CVE-2020-7919: Panic in certificate parsing in crypto/x509 and golang.org/x/crypto/cryptobyte

stdlib Updated 02 Oct 2025

Summary

06/07/2022

Disclosed on

CVE-2020-7919

CVE

Yes i

Fix available

Unrated

Severity

Not published

CVSS Score

CVE-2020-7919: Panic in certificate parsing in crypto/x509 and golang.org/x/crypto/cryptobyte. Affects stdlib across 2 version ranges.

< 1.12.16 >= 1.13.0-0, < 1.13.7

Fixed in 1.12.16 or 1.13.7, depending on the release line you run. How to fix ↓

Also tracked for

golang · Bitnami
github.com/helm/helm · Go

The same CVE-2020-7919 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The impacted package is the Go standard library (stdlib) and the golang.org/x/crypto package. The stdlib package provides a collection of core packages and modules for the Go programming language, while the golang.org/x/crypto package offers additional cryptographic primitives and algorithms. These packages are widely used in Go applications for various purposes, including TLS communication and certificate handling. However, a vulnerability has been discovered in the certificate parsing functionality of the crypto/x509 package and the ASN.1 parsing functions of the golang.org/x/crypto/cryptobyte package.

Vulnerability Detail

The vulnerability arises when a malformed input is provided to the crypto/x509 or cryptobyte ASN.1 parsing functions on 32-bit architectures. This malformed input can trigger a panic, leading to a crash or unexpected behavior in applications that utilize these packages. The vulnerability can be exploited by delivering a malformed certificate through a crypto/tls connection to a client or a server that accepts client certificates. While net/http clients can be made to crash by an HTTPS server, net/http servers that accept client certificates will recover from the panic and remain unaffected.

How To Fix

Latest published version: go1.25.5 as of 22 Oct 2026

go get stdlib@vgo1.25.5

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

< 1.12.16 1.12.16
```
go get stdlib@v1.12.16
```
>= 1.13.0-0, < 1.13.7 1.13.7
```
go get stdlib@v1.13.7
```

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

There is no specific workaround mentioned for this vulnerability.

Conclusion

In conclusion, the CVE-2020-7919 vulnerability affects the crypto/x509 and golang.org/x/crypto/cryptobyte packages in the Go standard library. It can lead to crashes or unexpected behavior in applications that utilize these packages, but net/http servers accepting client certificates are not directly affected. To mitigate the vulnerability, it is crucial to update the impacted packages to their fixed versions. For further support on vulnerability remediation, you can contact DevNack.com.

See every vulnerability recorded for stdlib →

FAQ

What is the impact of this vulnerability?

The impact of this vulnerability can vary depending on the application and its usage of the impacted packages. In some cases, it can lead to crashes or unexpected behavior, potentially disrupting the functionality of the application. However, net/http servers that accept client certificates are able to recover from the panic and are not directly affected.

How can I check if my application is affected?

You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using Gopkg.lock to analyze the software without requiring access to the code or installation.

Are there any known exploits for this vulnerability?

There are no known public exploits for this vulnerability at the time of this report. However, it is important to promptly update the impacted packages to mitigate any potential risks.

Can I apply any mitigations without updating the packages?

As of now, there are no specific mitigations mentioned for this vulnerability. It is recommended to update the packages to their fixed versions to ensure the security of your application.