CVE-2025-58185: Go stdlib Encoding/ASN1 Memory Exhaustion Vulnerability
Summary
CVE-2025-58185: Parsing DER payload can cause memory exhaustion in encoding/asn1. Affects stdlib across 2 version ranges.
< 1.24.8
>= 1.25.0, < 1.25.2
Fixed in 1.24.8 or 1.25.2, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2025-58185 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Go standard library (stdlib) provides essential packages for building applications in the Go programming language. Among these, the encoding/asn1 package is responsible for encoding and decoding data in the ASN.1 format, which is widely used in various protocols and data structures. This package is crucial for applications that require serialization and deserialization of complex data types. However, it is vulnerable to a specific issue that can lead to memory exhaustion when processing maliciously crafted DER payloads.
Vulnerability Detail
The vulnerability arises from the way the encoding/asn1 package parses DER (Distinguished Encoding Rules) payloads. When a maliciously crafted DER payload is processed, it can allocate excessive amounts of memory, leading to memory exhaustion. This can result in application crashes or degraded performance, making it a significant concern for developers relying on this package for data handling. The vulnerability affects versions of the Go standard library prior to 1.24.8 and between 1.25.0 and 1.25.2, where the issue has been addressed.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.24.81.24.8go get stdlib@v1.24.8 -
>= 1.25.0, < 1.25.21.25.2go get stdlib@v1.25.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can implement input validation to restrict the size and structure of DER payloads being processed. This can help mitigate the risk of memory exhaustion by rejecting excessively large or malformed inputs before they reach the parsing stage.
Conclusion
CVE-2025-58185 poses a serious risk to applications using the Go standard library's encoding/asn1 package. By understanding the vulnerability and following the recommended steps to update or implement workarounds, developers can protect their applications from potential memory exhaustion issues.
See every vulnerability recorded for stdlib →
FAQ
CVE-2025-58185 is a vulnerability in the Go standard library's encoding/asn1 package that can lead to memory exhaustion when parsing maliciously crafted DER payloads.
The affected versions are those prior to 1.24.8 and between 1.25.0 and 1.25.2.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Exploiting this vulnerability can lead to application crashes or degraded performance due to memory exhaustion.
Implement input validation to restrict the size and structure of DER payloads as a temporary workaround until you can update.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
