GitHub Advisoryadvisory · Go
GHSA-29c6-3hcj-89cf go-crypto-winnative BCryptGenerateSymmetricKey memory leak
HIGH
Official page ↗
- Aliases
- CVE-2025-25199
- Ecosystem
- Go
- Packages
- github.com/microsoft/go-crypto-winnative
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-401
- Reviewed
- 2025-02-12
Affected packages
• Go github.com/microsoft/go-crypto-winnative: < 0.0.0-20250211154640-f49c8e1379ea → fixed in 0.0.0-20250211154640-f49c8e1379ea
Description
Calls to `cng.TLS1PRF` don't release the key handle, producing a small memory leak every time.
Related
Alias · CVE (1)
- CVE-2025-25199 go-crypto-winnative Go crypto backend for Windows using Cryptography API: Next Generation (CNG). vulnerability
Weakness · CWE (1)
- CWE-401 Missing Release of Memory after Effective Lifetime weakness
References
- https://github.com/microsoft/go-crypto-winnative/security/advisories/GHSA-29c6-3hcj-89cf web
- https://nvd.nist.gov/vuln/detail/CVE-2025-25199 advisory
- https://github.com/microsoft/go-crypto-winnative/commit/f49c8e1379ea4b147d5bff1b3be5b0ff45792e41 web
- https://github.com/microsoft/go-crypto-winnative package