{"id":"CVE-2025-58188","title":"Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method","summary":"Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains.","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-295","CWE-617"],"vendor":"golang","product":"go","affected":["go < 1.24.8","go >= 1.25.0, < 1.25.2"],"patched":["go 1.25.2"],"published":"2025-10-29","updated":"2026-10-08","sourceUpdated":"2026-10-08T10:10:00.227","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-58188","references":[{"url":"https://go.dev/cl/709853","label":"security@golang.org"},{"url":"https://go.dev/issue/75675","label":"security@golang.org"},{"url":"https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","label":"security@golang.org"},{"url":"https://pkg.go.dev/vuln/GO-2025-4013","label":"security@golang.org"},{"url":"http://www.openwall.com/lists/oss-security/2025/10/08/1","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-58188.json"},{"url":"https://access.redhat.com/security/cve/CVE-2025-58188"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2407255"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-58188"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58188"},{"url":"https://access.redhat.com/errata/RHSA-2026:7385"},{"url":"https://access.redhat.com/errata/RHSA-2026:7291"}],"tags":["nvd","csaf","vex","red-hat","osv","go"],"epss":0.00381,"epssPercentile":0.31972,"aliases":["GO-2025-4013","BIT-golang-2025-58188"],"ecosystem":"go","ingestedAt":"2026-08-08T19:14:56.237Z","slug":"CVE-2025-58188","body":"## Overview\n\nValidating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains.\n\n## Affected\n\n- `go < 1.24.8`\n- `go >= 1.25.0, < 1.25.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `go 1.25.2`\n\n## Package advisory (CVE-2025-58188)\n\nAffected packages:\n\n- `stdlib >= 1.25.0, < 1.25.2`\n\nPatched in:\n\n- `stdlib 1.25.2`\n\nSource: https://osv.dev/vulnerability/GO-2025-4013\n\n## Vendor advisories\n\n- **RHSA-2026:7385** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-04-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:7385)\n- **RHSA-2026:7291** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-04-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:7291)\n- **Red Hat VEX** · Moderate · affected: Builds for Red Hat OpenShift, OpenShift Pipelines, Red Hat Developer Hub, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Dev Spaces, … · no fix planned: Builds for Red Hat OpenShift, Red Hat Developer Hub, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, … · updated 2026-09-10 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-58188.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":217946,"id":"CVE-2025-58188","ts":1791455361991,"field":"cvss","old":null,"new":"7.5"},{"seq":217945,"id":"CVE-2025-58188","ts":1791455361991,"field":"severity","old":"medium","new":"high"},{"seq":201412,"id":"CVE-2025-58188","ts":1789399417653,"field":"severity","old":"none","new":"medium"},{"seq":200147,"id":"CVE-2025-58188","ts":1789396853153,"field":"severity","old":"medium","new":"none"},{"seq":196941,"id":"CVE-2025-58188","ts":1789384264411,"field":"severity","old":"none","new":"medium"},{"seq":195868,"id":"CVE-2025-58188","ts":1789383254951,"field":"severity","old":"medium","new":"none"},{"seq":194796,"id":"CVE-2025-58188","ts":1789380245363,"field":"severity","old":"none","new":"medium"},{"seq":193584,"id":"CVE-2025-58188","ts":1789378111218,"field":"severity","old":"medium","new":"none"},{"seq":192370,"id":"CVE-2025-58188","ts":1789376154724,"field":"severity","old":"none","new":"medium"},{"seq":191158,"id":"CVE-2025-58188","ts":1789372972779,"field":"severity","old":"medium","new":"none"},{"seq":189942,"id":"CVE-2025-58188","ts":1789369072470,"field":"severity","old":"none","new":"medium"},{"seq":188730,"id":"CVE-2025-58188","ts":1789367939591,"field":"severity","old":"medium","new":"none"},{"seq":187512,"id":"CVE-2025-58188","ts":1789364915448,"field":"severity","old":"none","new":"medium"},{"seq":186300,"id":"CVE-2025-58188","ts":1789362881324,"field":"severity","old":"medium","new":"none"},{"seq":185085,"id":"CVE-2025-58188","ts":1789360901915,"field":"severity","old":"none","new":"medium"},{"seq":183873,"id":"CVE-2025-58188","ts":1789357786165,"field":"severity","old":"medium","new":"none"},{"seq":182125,"id":"CVE-2025-58188","ts":1789354040512,"field":"severity","old":"none","new":"medium"},{"seq":180918,"id":"CVE-2025-58188","ts":1789352816121,"field":"severity","old":"medium","new":"none"},{"seq":179711,"id":"CVE-2025-58188","ts":1789349915173,"field":"severity","old":"none","new":"medium"},{"seq":178504,"id":"CVE-2025-58188","ts":1789347654576,"field":"severity","old":"medium","new":"none"},{"seq":177297,"id":"CVE-2025-58188","ts":1789346104199,"field":"severity","old":"none","new":"medium"},{"seq":176090,"id":"CVE-2025-58188","ts":1789342613091,"field":"severity","old":"medium","new":"none"},{"seq":175876,"id":"CVE-2025-58188","ts":1789342216245,"field":"severity","old":"none","new":"medium"},{"seq":175414,"id":"CVE-2025-58188","ts":1789338251737,"field":"severity","old":"medium","new":"none"},{"seq":174209,"id":"CVE-2025-58188","ts":1789334540764,"field":"severity","old":"none","new":"medium"},{"seq":170632,"id":"CVE-2025-58188","ts":1789328236713,"field":"severity","old":"medium","new":"none"},{"seq":169427,"id":"CVE-2025-58188","ts":1789326824321,"field":"severity","old":"none","new":"medium"},{"seq":168222,"id":"CVE-2025-58188","ts":1789323259224,"field":"severity","old":"medium","new":"none"},{"seq":167017,"id":"CVE-2025-58188","ts":1789319299544,"field":"severity","old":"none","new":"medium"},{"seq":165812,"id":"CVE-2025-58188","ts":1789318105352,"field":"severity","old":"medium","new":"none"},{"seq":164607,"id":"CVE-2025-58188","ts":1789315476922,"field":"severity","old":"none","new":"medium"},{"seq":163402,"id":"CVE-2025-58188","ts":1789313139784,"field":"severity","old":"medium","new":"none"},{"seq":162197,"id":"CVE-2025-58188","ts":1789311659309,"field":"severity","old":"none","new":"medium"},{"seq":160992,"id":"CVE-2025-58188","ts":1789308119809,"field":"severity","old":"medium","new":"none"},{"seq":160958,"id":"CVE-2025-58188","ts":1789307894558,"field":"severity","old":"none","new":"medium"},{"seq":158335,"id":"CVE-2025-58188","ts":1789299147226,"field":"severity","old":"medium","new":"none"},{"seq":157299,"id":"CVE-2025-58188","ts":1789296403720,"field":"severity","old":"none","new":"medium"},{"seq":156094,"id":"CVE-2025-58188","ts":1789294256914,"field":"severity","old":"medium","new":"none"},{"seq":154889,"id":"CVE-2025-58188","ts":1789292558465,"field":"severity","old":"none","new":"medium"},{"seq":153684,"id":"CVE-2025-58188","ts":1789289190854,"field":"severity","old":"medium","new":"none"},{"seq":152896,"id":"CVE-2025-58188","ts":1789285079796,"field":"severity","old":"none","new":"medium"},{"seq":152140,"id":"CVE-2025-58188","ts":1789280801309,"field":"severity","old":"medium","new":"none"},{"seq":151101,"id":"CVE-2025-58188","ts":1789277356092,"field":"severity","old":"none","new":"medium"},{"seq":150068,"id":"CVE-2025-58188","ts":1789275785965,"field":"severity","old":"medium","new":"none"},{"seq":149035,"id":"CVE-2025-58188","ts":1789273552934,"field":"severity","old":"none","new":"medium"},{"seq":147830,"id":"CVE-2025-58188","ts":1789270753235,"field":"severity","old":"medium","new":"none"},{"seq":145870,"id":"CVE-2025-58188","ts":1789269134401,"field":"severity","old":"none","new":"medium"},{"seq":144774,"id":"CVE-2025-58188","ts":1789266029640,"field":"severity","old":"medium","new":"none"},{"seq":143678,"id":"CVE-2025-58188","ts":1789262361186,"field":"severity","old":"none","new":"medium"},{"seq":142514,"id":"CVE-2025-58188","ts":1789261088974,"field":"severity","old":"medium","new":"none"}]}