Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2025-22874

Usage of ExtKeyUsageAny disables policy validation in crypto/x509

Description

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Go standard library crypto/x509

Default version status: unaffected

  • 1.24.0-0 to < 1.24.4affected

References