CVE-2025-22874

Usage of ExtKeyUsageAny disables policy validation in crypto/x509

Published Jun 11, 2025 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Description
Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-18136 Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.
History
Type Values Removed Values Added
Metrics epss

{'score': 0.00024}

epss

{'score': 0.00012}

Type Values Removed Values Added
Metrics epss

{'score': 0.00022}

epss

{'score': 0.00024}

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.
Title Usage of ExtKeyUsageAny disables policy validation in crypto/x509
References

Subscriptions

No data.

Weaknesses

Sources

Status
PUBLISHED
Assigner
Go
Published
Updated
Jun 16, 2025, 8:26 PM
Reserved
Jan 8, 2025, 7:11 PM
Status
Deferred
Published
Jun 11, 2025, 5:15 PM
Modified
Jun 17, 2026, 8:50 AM
Severity
Important
Public date
Jun 11, 2025, 4:42 PM