CVE catalog

CVE-2025-22866

Go vulnerabilities

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.29% · Oct 25, 2026

Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private key when P-256 is used in any well known protocols.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-1.19bookworm1.19.8-2vulnerable
Ubuntugolang-1.19nobleNot reportedvulnerable
Ubuntugolang-1.22noble1.22.2-2ubuntu0.4fixed
Ubuntugolang-1.22-docnoble1.22.2-2ubuntu0.4fixed
Ubuntugolang-1.22-gonoble1.22.2-2ubuntu0.4fixed
Ubuntugolang-1.22-srcnoble1.22.2-2ubuntu0.4fixed
Susego1.22linux enterprise module for development tools 15 sp61.22.12-150000.1.42.1fixed
Opensusego1.22leap 15.61.22.12-150000.1.42.1fixed
Opensusego1.24tumbleweed1.24rc3-1.1fixed
Opensusegovulncheck-vulndbtumbleweed0.0.20250207T224745-1.1fixed
Opensusego1.23tumbleweed1.23.6-1.1fixed
Susego1.23linux enterprise module for development tools 15 sp61.23.6-150000.1.21.1fixed
Opensusego1.23leap 15.61.23.6-150000.1.21.1fixed
Susego1.24linux enterprise module for development tools 15 sp61.24rc3-150000.1.6.1fixed
Opensusego1.24leap 15.61.24rc3-150000.1.6.1fixed
Opensusego1.22tumbleweed1.22.12-1.1fixed
Ubuntugolang-1.1014.041.10.4-2ubuntu1~14.04.1vulnerable
Ubuntugolang-1.1016.041.10.4-2ubuntu1~16.04.1vulnerable
Ubuntugolang-1.1016.041.10.4-2ubuntu1~16.04.2vulnerable
Ubuntugolang-1.616.041.6-0ubuntu1vulnerable
Ubuntugolang-1.616.041.6-0ubuntu2vulnerable
Ubuntugolang-1.616.041.6-0ubuntu3vulnerable
Ubuntugolang-1.616.041.6-0ubuntu4vulnerable
Ubuntugolang-1.616.041.6-0ubuntu5vulnerable
Ubuntugolang-1.616.041.6.1-0ubuntu1vulnerable
Ubuntugolang-1.616.041.6.2-0ubuntu5~16.04vulnerable
Ubuntugolang-1.616.041.6.2-0ubuntu5~16.04.2vulnerable
Ubuntugolang-1.616.041.6.2-0ubuntu5~16.04.3vulnerable
Ubuntugolang-1.616.041.6.2-0ubuntu5~16.04.4vulnerable
Ubuntugolang-1.13pro1.13.8-1ubuntu2vulnerable
Ubuntugolang-1.13pro1.13.8-1ubuntu2.22.04.1vulnerable
Ubuntugolang-1.13pro1.13.8-1ubuntu2.22.04.1+esm1vulnerable
Ubuntugolang-1.13pro1.13.8-1ubuntu2.22.04.2vulnerable
Ubuntugolang-1.18pro1.18.1-1ubuntu1~18.04.3vulnerable
Ubuntugolang-1.18pro1.18.1-1ubuntu1~18.04.4vulnerable
Ubuntugolang-1.18pro1.18.1-1ubuntu1~18.04.4+esm1vulnerable
Ubuntugolang-1.1018.041.10~rc1-1vulnerable
Ubuntugolang-1.1018.041.10~rc1-1ubuntu1vulnerable
Ubuntugolang-1.1018.041.10~rc1-2ubuntu1vulnerable
Ubuntugolang-1.1018.041.10~rc2-1ubuntu1vulnerable
Ubuntugolang-1.1018.041.10-1ubuntu1vulnerable
Ubuntugolang-1.1018.041.10.1-1ubuntu2vulnerable
Ubuntugolang-1.1018.041.10.4-2ubuntu1~18.04.1vulnerable
Ubuntugolang-1.1018.041.10.4-2ubuntu1~18.04.2vulnerable
Ubuntugolang-1.16pro1.16.2-0ubuntu1~20.04vulnerable
Ubuntugolang-1.16pro1.16.2-0ubuntu1~20.04.1vulnerable
Ubuntugolang-1.16pro1.16.2-0ubuntu1~20.04.1+esm1vulnerable
Ubuntugolang-1.818.041.8.3-2ubuntu1vulnerable
Ubuntugolang-1.818.041.8.3-2ubuntu1.18.04.1vulnerable
Ubuntugolang-1.918.041.9.1-2ubuntu1vulnerable
Ubuntugolang-1.918.041.9.2-1ubuntu1vulnerable
Ubuntugolang-1.918.041.9.2-3ubuntu1vulnerable
Ubuntugolang-1.918.041.9.3-1ubuntu1vulnerable
Ubuntugolang-1.918.041.9.4-1ubuntu1vulnerable
Ubuntugolang-1.1320.041.13.1-1ubuntu1vulnerable
Ubuntugolang-1.1320.041.13.3-1ubuntu1vulnerable
Ubuntugolang-1.1320.041.13.4-1ubuntu1vulnerable
Ubuntugolang-1.1320.041.13.5-1ubuntu1vulnerable
Ubuntugolang-1.1320.041.13.6-1ubuntu1vulnerable
Ubuntugolang-1.1320.041.13.6-2ubuntu1vulnerable
Ubuntugolang-1.1320.041.13.7-1ubuntu1vulnerable
Ubuntugolang-1.1320.041.13.8-1ubuntu1vulnerable
Ubuntugolang-1.1320.041.13.8-1ubuntu1.1vulnerable
Ubuntugolang-1.1320.041.13.8-1ubuntu1.2vulnerable
Ubuntugolang-1.1420.041.14~beta1-1vulnerable
Ubuntugolang-1.1420.041.14~beta1-2vulnerable
Ubuntugolang-1.1420.041.14~rc1-1vulnerable
Ubuntugolang-1.1420.041.14-1vulnerable
Ubuntugolang-1.1420.041.14.1-1vulnerable
Ubuntugolang-1.1420.041.14.2-1vulnerable
Ubuntugolang-1.1420.041.14.2-1ubuntu1vulnerable
Ubuntugolang-1.1420.041.14.3-2ubuntu2~20.04.1vulnerable
Ubuntugolang-1.1420.041.14.3-2ubuntu2~20.04.2vulnerable
Ubuntugolang-1.1820.041.18.1-1ubuntu1~20.04.1vulnerable
Ubuntugolang-1.1820.041.18.1-1ubuntu1~20.04.2vulnerable
Ubuntugolang-1.1820.041.18.1-1ubuntu1~20.04.3vulnerable
Ubuntugolang-1.2020.041.20.3-1ubuntu0.1~20.04vulnerable
Ubuntugolang-1.2020.041.20.3-1ubuntu0.1~20.04.1vulnerable
Ubuntugolang-1.2120.041.21.1-1~ubuntu20.04.1vulnerable
Ubuntugolang-1.2120.041.21.1-1~ubuntu20.04.2vulnerable
Ubuntugolang-1.2120.041.21.1-1~ubuntu20.04.3vulnerable
Ubuntugolang-1.2220.041.22.2-2~20.04.1vulnerable
Ubuntugolang-1.2220.041.22.2-2~20.04.2vulnerable
Ubuntugolang-1.2220.041.22.2-2~20.04.3vulnerable
Ubuntugolang-1.1722.041.17-1ubuntu2vulnerable
Ubuntugolang-1.1722.041.17.3-1ubuntu1vulnerable
Ubuntugolang-1.1722.041.17.3-1ubuntu2vulnerable
Ubuntugolang-1.1722.041.17.13-3ubuntu1vulnerable
Ubuntugolang-1.1722.041.17.13-3ubuntu1.2vulnerable
Ubuntugolang-1.1722.041.17.13-3ubuntu1.3vulnerable
Ubuntugolang-1.1822.041.18~beta1-0ubuntu1vulnerable
Ubuntugolang-1.1822.041.18~beta2-1ubuntu1vulnerable
Ubuntugolang-1.1822.041.18~beta2-1ubuntu2vulnerable
Ubuntugolang-1.1822.041.18~rc1-1ubuntu1vulnerable
Ubuntugolang-1.1822.041.18-1ubuntu1vulnerable
Ubuntugolang-1.1822.041.18.1-1ubuntu1vulnerable
Ubuntugolang-1.1822.041.18.1-1ubuntu1.1vulnerable
Ubuntugolang-1.1822.041.18.1-1ubuntu1.2vulnerable
Ubuntugolang-1.1822.041.18.1-1ubuntu1.3vulnerable
Ubuntugolang-1.2022.041.20.3-1ubuntu0.1~22.04vulnerable
Ubuntugolang-1.2022.041.20.3-1ubuntu0.1~22.04.1vulnerable
Ubuntugolang-1.2122.041.21.1-1~ubuntu22.04.1vulnerable
Ubuntugolang-1.2122.041.21.1-1~ubuntu22.04.2vulnerable
Ubuntugolang-1.2122.041.21.1-1~ubuntu22.04.3vulnerable
Ubuntugolang-1.2122.041.21.1-1~ubuntu22.04.4vulnerable
Ubuntugolang-1.2222.041.22.2-2~22.04vulnerable
Ubuntugolang-1.2222.041.22.2-2~22.04.1vulnerable
Ubuntugolang-1.2222.041.22.2-2~22.04.2vulnerable
Ubuntugolang-1.2222.041.22.2-2~22.04.3fixed
Ubuntugolang-1.2322.041.23.1-1~22.04vulnerable
Ubuntugolang-1.2322.041.23.1-1~22.04.2vulnerable
Ubuntugolang-1.2322.041.23.1-1~22.04.3vulnerable
Ubuntugolang-1.2422.041.24.4-1ubuntu1~22.04.1vulnerable
Ubuntugolang-1.2422.041.24.4-1ubuntu1~22.04.2vulnerable
Ubuntugolang-1.2422.041.24.13-2~22.04.1vulnerable
Ubuntugolang-1.2422.041.24.13-2~22.04.2vulnerable
Ubuntugolang-1.2124.041.21.1-1vulnerable
Ubuntugolang-1.2124.041.21.3-1vulnerable
Ubuntugolang-1.2124.041.21.4-1vulnerable
Ubuntugolang-1.2124.041.21.5-1vulnerable
Ubuntugolang-1.2124.041.21.6-1vulnerable
Ubuntugolang-1.2124.041.21.7-1vulnerable
Ubuntugolang-1.2124.041.21.7-2vulnerable
Ubuntugolang-1.2124.041.21.8-1vulnerable
Ubuntugolang-1.2124.041.21.8-1build1vulnerable
Ubuntugolang-1.2124.041.21.9-1vulnerable
Ubuntugolang-1.2124.041.21.9-1ubuntu0.1vulnerable
Ubuntugolang-1.2224.041.22~rc1-2vulnerable
Ubuntugolang-1.2224.041.22.0-1vulnerable
Ubuntugolang-1.2224.041.22.0-2vulnerable
Ubuntugolang-1.2224.041.22.1-1vulnerable
Ubuntugolang-1.2224.041.22.1-1build1vulnerable
Ubuntugolang-1.2224.041.22.2-2vulnerable
Ubuntugolang-1.2224.041.22.2-2ubuntu0.1vulnerable
Ubuntugolang-1.2224.041.22.2-2ubuntu0.2vulnerable
Ubuntugolang-1.2224.041.22.2-2ubuntu0.3vulnerable
Ubuntugolang-1.2224.041.22.2-2ubuntu0.4fixed
Ubuntugolang-1.2324.041.23.1-1~24.04vulnerable
Ubuntugolang-1.2324.041.23.1-1~24.04.1vulnerable
Ubuntugolang-1.2424.041.24.4-1ubuntu1~24.04.1vulnerable
Ubuntugolang-1.2424.041.24.4-1ubuntu1~24.04.2vulnerable
Ubuntugolang-1.2424.041.24.13-2~24.04.1vulnerable
Ubuntugolang-1.2325.101.23.8-1vulnerable
Ubuntugolang-1.2325.101.23.10-1vulnerable
Ubuntugolang-1.2325.101.23.10-1ubuntu0.2vulnerable
Ubuntugolang-1.2425.101.24.2-1vulnerable
Ubuntugolang-1.2425.101.24.2-2vulnerable
Ubuntugolang-1.2425.101.24.4-1vulnerable
Ubuntugolang-1.2425.101.24.4-1ubuntu1vulnerable
Ubuntugolang-1.2326.041.23.10-1vulnerable
Ubuntugolang-1.2426.041.24.4-1ubuntu1vulnerable
Ubuntugolang-1.2426.041.24.9-1vulnerable
Ubuntugolang-1.2426.041.24.13-2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-1.19sourcebookworm(unfixed)not yet assignedNot reportedNot reported
Ubuntugolang-1.22debnoble1.22.2-2ubuntu0.4Not reportedNot reportedNot reported
Ubuntugolang-1.22-docdebnoble1.22.2-2ubuntu0.4Not reportedNot reportedNot reported
Ubuntugolang-1.22-godebnoble1.22.2-2ubuntu0.4Not reportedNot reportedNot reported
Ubuntugolang-1.22-srcdebnoble1.22.2-2ubuntu0.4Not reportedNot reportedNot reported
Susego1.22rpmlinux enterprise module for development tools 15 sp61.22.12-150000.1.42.1Not reportedSUSE-SU-2025:0392-1Not reported
Opensusego1.22rpmleap 15.61.22.12-150000.1.42.1Not reportedSUSE-SU-2025:0392-1Not reported
Opensusego1.24rpmtumbleweed1.24rc3-1.1Not reportedOPENSUSE-SU-2025:14735-1Not reported
Opensusegovulncheck-vulndbrpmtumbleweed0.0.20250207T224745-1.1Not reportedOPENSUSE-SU-2025:14754-1Not reported
Opensusego1.23rpmtumbleweed1.23.6-1.1Not reportedOPENSUSE-SU-2025:14746-1Not reported
Susego1.23rpmlinux enterprise module for development tools 15 sp61.23.6-150000.1.21.1Not reportedSUSE-SU-2025:0393-1Not reported
Opensusego1.23rpmleap 15.61.23.6-150000.1.21.1Not reportedSUSE-SU-2025:0393-1Not reported
Susego1.24rpmlinux enterprise module for development tools 15 sp61.24rc3-150000.1.6.1Not reportedSUSE-SU-2025:0431-1Not reported
Opensusego1.24rpmleap 15.61.24rc3-150000.1.6.1Not reportedSUSE-SU-2025:0431-1Not reported
Opensusego1.22rpmtumbleweed1.22.12-1.1Not reportedOPENSUSE-SU-2025:14745-1Not reported
Ubuntugolang-1.22deb22.041.22.2-2~22.04.3Not reportedUBUNTU-CVE-2025-22866Not reported
Ubuntugolang-1.22deb24.041.22.2-2ubuntu0.4Not reportedUBUNTU-CVE-2025-22866Not reported

Notes

[bookworm] golang-1.19: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-1.19]Affected
    Details (2)
    • 1.19.8-2 · all · bookworm

      Affected

      usn · golang-1.19 · debian · bookworm; usn · golang-1.19 · debian · 12

    • 1.19.8-2 · all · bookworm

      Affected

      usn · golang-1.19 · debian · bookworm; usn · golang-1.19 · debian · 12

  • [golang-1.19-doc]Affected

    Source package: [golang-1.19]

    Details (2)
    • 1.19.8-2 · all · bookworm

      Affected

      usn · golang-1.19 · debian · bookworm; usn · golang-1.19 · debian · 12

    • 1.19.8-2 · all · bookworm

      Affected

      usn · golang-1.19 · debian · bookworm; usn · golang-1.19 · debian · 12

  • [golang-1.19-go]Affected

    Source package: [golang-1.19]

    Details (2)
    • 1.19.8-2 · amd64 · bookworm

      Affected

      usn · golang-1.19 · debian · bookworm; usn · golang-1.19 · debian · 12

    • 1.19.8-2 · arm64 · bookworm

      Affected

      usn · golang-1.19 · debian · bookworm; usn · golang-1.19 · debian · 12

  • [golang-1.19-src]Affected

    Source package: [golang-1.19]

    Details (2)
    • 1.19.8-2 · all · bookworm

      Affected

      usn · golang-1.19 · debian · bookworm; usn · golang-1.19 · debian · 12

    • 1.19.8-2 · all · bookworm

      Affected

      usn · golang-1.19 · debian · bookworm; usn · golang-1.19 · debian · 12

[openSUSE Tumbleweed]

  • [go1.22-doc]Unknown

    Source package: [go1.22]

    Details (1)
    • 1.22.12-7.2 · x86_64 · tumbleweed

      Unknown · Fixed: 1.22.12-1.1

      Version impact unknown

      usn · go1.22 · opensuse · tumbleweed

  • [go1.22-race]Unknown

    Source package: [go1.22]

    Details (1)
    • 1.22.12-7.2 · x86_64 · tumbleweed

      Unknown · Fixed: 1.22.12-1.1

      Version impact unknown

      usn · go1.22 · opensuse · tumbleweed

  • [go1.23-doc]Unknown

    Source package: [go1.23]

    Details (1)
    • 1.23.12-6.2 · x86_64 · tumbleweed

      Unknown · Fixed: 1.23.6-1.1

      Version impact unknown

      usn · go1.23 · opensuse · tumbleweed

  • [go1.23-race]Unknown

    Source package: [go1.23]

    Details (1)
    • 1.23.12-6.2 · x86_64 · tumbleweed

      Unknown · Fixed: 1.23.6-1.1

      Version impact unknown

      usn · go1.23 · opensuse · tumbleweed

  • [go1.24-doc]Unknown

    Source package: [go1.24]

    Details (1)
    • 1.24.13-5.2 · x86_64 · tumbleweed

      Unknown · Fixed: 1.24rc3-1.1

      Version impact unknown

      usn · go1.24 · opensuse · tumbleweed

  • [go1.24-race]Unknown

    Source package: [go1.24]

    Details (1)
    • 1.24.13-5.2 · x86_64 · tumbleweed

      Unknown · Fixed: 1.24rc3-1.1

      Version impact unknown

      usn · go1.24 · opensuse · tumbleweed

  • [go1.22]Fixed

    Source package: [go1.22]

    Details (1)
    • 1.22.12-7.2 · x86_64 · tumbleweed

      Fixed · Fixed: 1.22.12-1.1

      usn · go1.22 · opensuse · tumbleweed

  • [go1.23]Fixed

    Source package: [go1.23]

    Details (1)
    • 1.23.12-6.2 · x86_64 · tumbleweed

      Fixed · Fixed: 1.23.6-1.1

      usn · go1.23 · opensuse · tumbleweed

  • [go1.24]Fixed

    Source package: [go1.24]

    Details (1)
    • 1.24.13-5.2 · x86_64 · tumbleweed

      Fixed · Fixed: 1.24rc3-1.1

      usn · go1.24 · opensuse · tumbleweed

  • Source package: [govulncheck-vulndb]

    Details (1)
    • 0.0.20260828T144745-1.1 · noarch · tumbleweed

      Fixed · Fixed: 0.0.20250207T224745-1.1

      usn · govulncheck-vulndb · opensuse · tumbleweed

[Debian 13 (Trixie)]

  • Details (2)
    • 1.24.4-1 · all · trixie

      Fixed · Fixed: 1.24~rc3-1

      usn · golang-1.24 · debian · 13

    • 1.24.4-1 · all · trixie

      Fixed · Fixed: 1.24~rc3-1

      usn · golang-1.24 · debian · 13

  • Source package: [golang-1.24]

    Details (2)
    • 1.24.4-1 · all · trixie

      Fixed · Fixed: 1.24~rc3-1

      usn · golang-1.24 · debian · 13

    • 1.24.4-1 · all · trixie

      Fixed · Fixed: 1.24~rc3-1

      usn · golang-1.24 · debian · 13

  • Source package: [golang-1.24]

    Details (2)
    • 1.24.4-1 · amd64 · trixie

      Fixed · Fixed: 1.24~rc3-1

      usn · golang-1.24 · debian · 13

    • 1.24.4-1 · arm64 · trixie

      Fixed · Fixed: 1.24~rc3-1

      usn · golang-1.24 · debian · 13

  • Source package: [golang-1.24]

    Details (2)
    • 1.24.4-1 · all · trixie

      Fixed · Fixed: 1.24~rc3-1

      usn · golang-1.24 · debian · 13

    • 1.24.4-1 · all · trixie

      Fixed · Fixed: 1.24~rc3-1

      usn · golang-1.24 · debian · 13

Observed:

References