crypto/x509: ParsePKCS1PrivateKey panic with partial keys [CVE-2025-22865] #71216
Closed
Description
Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic
when verifying that the key is well formed.
Thanks to Philippe Antoine (Catena cyber) for reporting this issue.
This is CVE-2025-22865.
Tracked in http://b/388805795 and fixed by https://go-internal-review.googlesource.com/c/go/+/1820.
/cc @golang/security and @golang/release