---
id: CVE-2025-58188
title: >-
  crypto/x509: golang: Panic when validating certificates with DSA public keys
  in crypto/x509 (CVE-2025-58188)
summary: >-
  A denial of service vector has been discovered in the golang crypto/x509
  module. An attacker could craft an intermediate X.509 certificate containing a
  DSA public key and can crash a remote host with an unauthenticated call to any
  endpoint…
severity: medium
cwe: CWE-617
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4
affected:
  - builds_for_red_hat_openshift
  - openshift_pipelines
  - developer_hub
  - enterprise_linux 10
  - enterprise_linux 9
  - openshift_dev_spaces
  - openshift_dev_workspaces_operator
  - openshift_gitops
  - assisted_installer_for_red_hat_openshift_container_platform 2
  - cert_manager_operator_for_red_hat_openshift
  - compliance_operator
  - confidential_compute_attestation
  - cryostat 4
  - custom_metric_autoscaler_operator_for_red_hat_openshift
  - deployment_validation_operator
  - external_secrets_operator_for_red_hat_openshift
  - externaldns_operator
  - fence_agents_remediation_operator
  - file_integrity_operator
  - gatekeeper 3
  - logging_subsystem_for_red_hat_openshift
  - logical_volume_manager_storage
  - machine_deletion_remediation_operator
  - migration_toolkit_for_applications 8
  - migration_toolkit_for_containers
  - mirror_registry_for_red_hat_openshift
  - mirror_registry_for_red_hat_openshift 2
  - multicluster_engine_for_kubernetes
  - multicluster_global_hub
  - network_observability_operator
  - node_healthcheck_operator
  - openshift_api_for_data_protection
  - openshift_developer_tools_and_services
  - openshift_lightspeed
  - openshift_serverless
  - openshift_service_mesh 2
  - openshift_service_mesh 3
  - power_monitoring_for_red_hat_openshift
  - 3scale_api_management_platform 2
  - advanced_cluster_management_for_kubernetes 2
patched:
  - hardened_images
published: '2025-10-29'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T04:01:20+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-58188.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-58188.json
  - url: 'https://access.redhat.com/security/cve/CVE-2025-58188'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2407255'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2025-58188'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-58188'
  - url: 'https://access.redhat.com/errata/RHSA-2026:7385'
  - url: 'https://access.redhat.com/errata/RHSA-2026:7291'
  - url: 'https://go.dev/cl/709853'
  - url: 'https://go.dev/issue/75675'
  - url: 'https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - go
epss: 0.00356
epssPercentile: 0.26649
aliases:
  - GO-2025-4013
  - BIT-golang-2025-58188
ecosystem: go
ingestedAt: '2026-08-08T19:14:56.237Z'
---

## Overview

A denial of service vector has been discovered in the golang crypto/x509 module. An attacker could craft an intermediate X.509 certificate containing a DSA public key and can crash a remote host with an unauthenticated call to any endpoint that verifies the certificate chain.

## Vendor advisories

- **RHSA-2026:7385** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-04-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:7385)
- **RHSA-2026:7291** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-04-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:7291)
- **Red Hat VEX** · Moderate · affected: Builds for Red Hat OpenShift, OpenShift Pipelines, Red Hat Developer Hub, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Dev Spaces, … · no fix planned: Builds for Red Hat OpenShift, Red Hat Developer Hub, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, … · updated 2026-09-10 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-58188.json)

**crypto/x509: golang: Panic when validating certificates with DSA public keys in crypto/x509** — rated Moderate by Red Hat. Released 2025-10-29, updated 2026-09-10.

Affected:

- Builds for Red Hat OpenShift
- OpenShift Pipelines
- Red Hat Developer Hub
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift Dev Workspaces Operator
- Red Hat OpenShift GitOps
- Assisted Installer for Red Hat OpenShift Container Platform 2
- cert-manager Operator for Red Hat OpenShift
- Compliance Operator
- Confidential Compute Attestation
- Cryostat 4
- Custom Metric Autoscaler operator for Red Hat Openshift
- Deployment Validation Operator
- External Secrets Operator for Red Hat OpenShift
- ExternalDNS Operator
- Fence Agents Remediation Operator
- File Integrity Operator
- Gatekeeper 3
- Logging Subsystem for Red Hat OpenShift
- Logical Volume Manager Storage
- Machine Deletion Remediation Operator
- Migration Toolkit for Applications 8
- Migration Toolkit for Containers
- mirror registry for Red Hat OpenShift
- mirror registry for Red Hat OpenShift 2
- Multicluster Engine for Kubernetes
- Multicluster Global Hub
- Network Observability Operator
- Node HealthCheck Operator
- OpenShift API for Data Protection
- OpenShift Developer Tools and Services
- OpenShift Lightspeed
- OpenShift Serverless
- OpenShift Service Mesh 2
- OpenShift Service Mesh 3
- Power monitoring for Red Hat OpenShift
- Red Hat 3scale API Management Platform 2
- Red Hat Advanced Cluster Management for Kubernetes 2

Fixed:

- Red Hat Hardened Images

No fix planned:

- Builds for Red Hat OpenShift
- Red Hat Developer Hub
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift GitOps
- OpenShift Pipelines
- Red Hat OpenShift Dev Workspaces Operator

Not affected:

- Builds for Red Hat OpenShift
- OpenShift Pipelines
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift GitOps
- Red Hat Trusted Artifact Signer
- Red Hat Web Terminal

## Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:7385
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:7291

Workarounds / mitigations:

- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

## Package advisory (CVE-2025-58188)

Affected packages:

- `stdlib >= 1.25.0, < 1.25.2`

Patched in:

- `stdlib 1.25.2`

Source: https://osv.dev/vulnerability/GO-2025-4013