GHSA-78hx-gp6g-7mj6
GitHub Security Advisory
Memory leaks in code encrypting and verifying RSA payloads
✓ GitHub Reviewed
HIGH
Has CVE
Advisory Details
Using crafted public RSA keys which are not compliant with SP 800-56B can cause a small memory leak when encrypting and verifying payloads.
An attacker can leverage this flaw to gradually erode available memory to the point where the host crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.
Affected Packages
Go
github.com/golang-fips/go
Affected versions:
0
(last affected: 1.22.1)
Go
github.com/golang-fips/openssl/v2
Affected versions:
0
(fixed in 2.0.1)
Go
github.com/microsoft/go-crypto-openssl
Affected versions:
0
(last affected: 0.2.8)
Go
github.com/microsoft/go-crypto-openssl/openssl
Affected versions:
0
(fixed in 0.2.9)
Related CVEs
Key Information
7.5
/10
Dataset
Last updated: June 18, 2025 6:25 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.