{"id":"CVE-2025-58188","title":"crypto/x509: golang: Panic when validating certificates with DSA public keys in crypto/x509 (CVE-2025-58188)","summary":"A denial of service vector has been discovered in the golang crypto/x509 module. An attacker could craft an intermediate X.509 certificate containing a DSA public key and can crash a remote host with an unauthenticated call to any endpoint…","severity":"medium","cwe":"CWE-617","vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","affected":["builds_for_red_hat_openshift","openshift_pipelines","developer_hub","enterprise_linux 10","enterprise_linux 9","openshift_dev_spaces","openshift_dev_workspaces_operator","openshift_gitops","assisted_installer_for_red_hat_openshift_container_platform 2","cert_manager_operator_for_red_hat_openshift","compliance_operator","confidential_compute_attestation","cryostat 4","custom_metric_autoscaler_operator_for_red_hat_openshift","deployment_validation_operator","external_secrets_operator_for_red_hat_openshift","externaldns_operator","fence_agents_remediation_operator","file_integrity_operator","gatekeeper 3","logging_subsystem_for_red_hat_openshift","logical_volume_manager_storage","machine_deletion_remediation_operator","migration_toolkit_for_applications 8","migration_toolkit_for_containers","mirror_registry_for_red_hat_openshift","mirror_registry_for_red_hat_openshift 2","multicluster_engine_for_kubernetes","multicluster_global_hub","network_observability_operator","node_healthcheck_operator","openshift_api_for_data_protection","openshift_developer_tools_and_services","openshift_lightspeed","openshift_serverless","openshift_service_mesh 2","openshift_service_mesh 3","power_monitoring_for_red_hat_openshift","3scale_api_management_platform 2","advanced_cluster_management_for_kubernetes 2"],"patched":["hardened_images"],"published":"2025-10-29","updated":"2026-09-10","sourceUpdated":"2026-09-10T04:01:20+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-58188.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-58188.json"},{"url":"https://access.redhat.com/security/cve/CVE-2025-58188"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2407255"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-58188"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58188"},{"url":"https://access.redhat.com/errata/RHSA-2026:7385"},{"url":"https://access.redhat.com/errata/RHSA-2026:7291"},{"url":"https://go.dev/cl/709853"},{"url":"https://go.dev/issue/75675"},{"url":"https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"}],"tags":["csaf","vex","red-hat","osv","go"],"epss":0.00356,"epssPercentile":0.29275,"aliases":["GO-2025-4013","BIT-golang-2025-58188"],"ecosystem":"go","ingestedAt":"2026-08-08T19:14:56.237Z","slug":"CVE-2025-58188","body":"## Overview\n\nA denial of service vector has been discovered in the golang crypto/x509 module. An attacker could craft an intermediate X.509 certificate containing a DSA public key and can crash a remote host with an unauthenticated call to any endpoint that verifies the certificate chain.\n\n## Vendor advisories\n\n- **RHSA-2026:7385** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-04-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:7385)\n- **RHSA-2026:7291** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-04-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:7291)\n- **Red Hat VEX** · Moderate · affected: Builds for Red Hat OpenShift, OpenShift Pipelines, Red Hat Developer Hub, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Dev Spaces, … · no fix planned: Builds for Red Hat OpenShift, Red Hat Developer Hub, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, … · updated 2026-09-10 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-58188.json)\n\n**crypto/x509: golang: Panic when validating certificates with DSA public keys in crypto/x509** — rated Moderate by Red Hat. Released 2025-10-29, updated 2026-09-10.\n\nAffected:\n\n- Builds for Red Hat OpenShift\n- OpenShift Pipelines\n- Red Hat Developer Hub\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Dev Spaces\n- Red Hat OpenShift Dev Workspaces Operator\n- Red Hat OpenShift GitOps\n- Assisted Installer for Red Hat OpenShift Container Platform 2\n- cert-manager Operator for Red Hat OpenShift\n- Compliance Operator\n- Confidential Compute Attestation\n- Cryostat 4\n- Custom Metric Autoscaler operator for Red Hat Openshift\n- Deployment Validation Operator\n- External Secrets Operator for Red Hat OpenShift\n- ExternalDNS Operator\n- Fence Agents Remediation Operator\n- File Integrity Operator\n- Gatekeeper 3\n- Logging Subsystem for Red Hat OpenShift\n- Logical Volume Manager Storage\n- Machine Deletion Remediation Operator\n- Migration Toolkit for Applications 8\n- Migration Toolkit for Containers\n- mirror registry for Red Hat OpenShift\n- mirror registry for Red Hat OpenShift 2\n- Multicluster Engine for Kubernetes\n- Multicluster Global Hub\n- Network Observability Operator\n- Node HealthCheck Operator\n- OpenShift API for Data Protection\n- OpenShift Developer Tools and Services\n- OpenShift Lightspeed\n- OpenShift Serverless\n- OpenShift Service Mesh 2\n- OpenShift Service Mesh 3\n- Power monitoring for Red Hat OpenShift\n- Red Hat 3scale API Management Platform 2\n- Red Hat Advanced Cluster Management for Kubernetes 2\n\nFixed:\n\n- Red Hat Hardened Images\n\nNo fix planned:\n\n- Builds for Red Hat OpenShift\n- Red Hat Developer Hub\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Dev Spaces\n- Red Hat OpenShift GitOps\n- OpenShift Pipelines\n- Red Hat OpenShift Dev Workspaces Operator\n\nNot affected:\n\n- Builds for Red Hat OpenShift\n- OpenShift Pipelines\n- Red Hat OpenShift Dev Spaces\n- Red Hat OpenShift GitOps\n- Red Hat Trusted Artifact Signer\n- Red Hat Web Terminal\n\n## Remediation\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:7385\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:7291\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\n## Package advisory (CVE-2025-58188)\n\nAffected packages:\n\n- `stdlib >= 1.25.0, < 1.25.2`\n\nPatched in:\n\n- `stdlib 1.25.2`\n\nSource: https://osv.dev/vulnerability/GO-2025-4013","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201412,"id":"CVE-2025-58188","ts":1789399417653,"field":"severity","old":"none","new":"medium"},{"seq":200147,"id":"CVE-2025-58188","ts":1789396853153,"field":"severity","old":"medium","new":"none"},{"seq":196941,"id":"CVE-2025-58188","ts":1789384264411,"field":"severity","old":"none","new":"medium"},{"seq":195868,"id":"CVE-2025-58188","ts":1789383254951,"field":"severity","old":"medium","new":"none"},{"seq":194796,"id":"CVE-2025-58188","ts":1789380245363,"field":"severity","old":"none","new":"medium"},{"seq":193584,"id":"CVE-2025-58188","ts":1789378111218,"field":"severity","old":"medium","new":"none"},{"seq":192370,"id":"CVE-2025-58188","ts":1789376154724,"field":"severity","old":"none","new":"medium"},{"seq":191158,"id":"CVE-2025-58188","ts":1789372972779,"field":"severity","old":"medium","new":"none"},{"seq":189942,"id":"CVE-2025-58188","ts":1789369072470,"field":"severity","old":"none","new":"medium"},{"seq":188730,"id":"CVE-2025-58188","ts":1789367939591,"field":"severity","old":"medium","new":"none"},{"seq":187512,"id":"CVE-2025-58188","ts":1789364915448,"field":"severity","old":"none","new":"medium"},{"seq":186300,"id":"CVE-2025-58188","ts":1789362881324,"field":"severity","old":"medium","new":"none"},{"seq":185085,"id":"CVE-2025-58188","ts":1789360901915,"field":"severity","old":"none","new":"medium"},{"seq":183873,"id":"CVE-2025-58188","ts":1789357786165,"field":"severity","old":"medium","new":"none"},{"seq":182125,"id":"CVE-2025-58188","ts":1789354040512,"field":"severity","old":"none","new":"medium"},{"seq":180918,"id":"CVE-2025-58188","ts":1789352816121,"field":"severity","old":"medium","new":"none"},{"seq":179711,"id":"CVE-2025-58188","ts":1789349915173,"field":"severity","old":"none","new":"medium"},{"seq":178504,"id":"CVE-2025-58188","ts":1789347654576,"field":"severity","old":"medium","new":"none"},{"seq":177297,"id":"CVE-2025-58188","ts":1789346104199,"field":"severity","old":"none","new":"medium"},{"seq":176090,"id":"CVE-2025-58188","ts":1789342613091,"field":"severity","old":"medium","new":"none"},{"seq":175876,"id":"CVE-2025-58188","ts":1789342216245,"field":"severity","old":"none","new":"medium"},{"seq":175414,"id":"CVE-2025-58188","ts":1789338251737,"field":"severity","old":"medium","new":"none"},{"seq":174209,"id":"CVE-2025-58188","ts":1789334540764,"field":"severity","old":"none","new":"medium"},{"seq":170632,"id":"CVE-2025-58188","ts":1789328236713,"field":"severity","old":"medium","new":"none"},{"seq":169427,"id":"CVE-2025-58188","ts":1789326824321,"field":"severity","old":"none","new":"medium"},{"seq":168222,"id":"CVE-2025-58188","ts":1789323259224,"field":"severity","old":"medium","new":"none"},{"seq":167017,"id":"CVE-2025-58188","ts":1789319299544,"field":"severity","old":"none","new":"medium"},{"seq":165812,"id":"CVE-2025-58188","ts":1789318105352,"field":"severity","old":"medium","new":"none"},{"seq":164607,"id":"CVE-2025-58188","ts":1789315476922,"field":"severity","old":"none","new":"medium"},{"seq":163402,"id":"CVE-2025-58188","ts":1789313139784,"field":"severity","old":"medium","new":"none"},{"seq":162197,"id":"CVE-2025-58188","ts":1789311659309,"field":"severity","old":"none","new":"medium"},{"seq":160992,"id":"CVE-2025-58188","ts":1789308119809,"field":"severity","old":"medium","new":"none"},{"seq":160958,"id":"CVE-2025-58188","ts":1789307894558,"field":"severity","old":"none","new":"medium"},{"seq":158335,"id":"CVE-2025-58188","ts":1789299147226,"field":"severity","old":"medium","new":"none"},{"seq":157299,"id":"CVE-2025-58188","ts":1789296403720,"field":"severity","old":"none","new":"medium"},{"seq":156094,"id":"CVE-2025-58188","ts":1789294256914,"field":"severity","old":"medium","new":"none"},{"seq":154889,"id":"CVE-2025-58188","ts":1789292558465,"field":"severity","old":"none","new":"medium"},{"seq":153684,"id":"CVE-2025-58188","ts":1789289190854,"field":"severity","old":"medium","new":"none"},{"seq":152896,"id":"CVE-2025-58188","ts":1789285079796,"field":"severity","old":"none","new":"medium"},{"seq":152140,"id":"CVE-2025-58188","ts":1789280801309,"field":"severity","old":"medium","new":"none"},{"seq":151101,"id":"CVE-2025-58188","ts":1789277356092,"field":"severity","old":"none","new":"medium"},{"seq":150068,"id":"CVE-2025-58188","ts":1789275785965,"field":"severity","old":"medium","new":"none"},{"seq":149035,"id":"CVE-2025-58188","ts":1789273552934,"field":"severity","old":"none","new":"medium"},{"seq":147830,"id":"CVE-2025-58188","ts":1789270753235,"field":"severity","old":"medium","new":"none"},{"seq":145870,"id":"CVE-2025-58188","ts":1789269134401,"field":"severity","old":"none","new":"medium"},{"seq":144774,"id":"CVE-2025-58188","ts":1789266029640,"field":"severity","old":"medium","new":"none"},{"seq":143678,"id":"CVE-2025-58188","ts":1789262361186,"field":"severity","old":"none","new":"medium"},{"seq":142514,"id":"CVE-2025-58188","ts":1789261088974,"field":"severity","old":"medium","new":"none"},{"seq":141350,"id":"CVE-2025-58188","ts":1789258564591,"field":"severity","old":"none","new":"medium"},{"seq":140152,"id":"CVE-2025-58188","ts":1789256270143,"field":"severity","old":"medium","new":"none"}]}