What is CVE-2025-22866?

CVE-2025-22866 is a medium-severity vulnerability in Go Standard Library Crypto/internal/nistec, classified under CWE-208: OBSERVABLE TIMING DISCREPANCY. CVSS score: 4.0/10. Published 2025-02-06.

How severe is CVE-2025-22866?

Medium severity. CVSS v3 base score is 4.0 out of 10.

Is CVE-2025-22866 known to be exploited?

5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Go Standard Library Crypto/internal/nistec

CVE-2025-22866

Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private key when P-256 is used in any well known protocols.

EPSS: 0.003 (20.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.0 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Go Standard Library Crypto/internal/nistec — versions 0, 1.23.0-0, 1.24.0-0

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2025-22866?: CVE-2025-22866 is a medium-severity vulnerability in Go Standard Library Crypto/internal/nistec, classified under CWE-208: OBSERVABLE TIMING DISCREPANCY. CVSS score: 4.0/10. Published 2025-02-06.
How severe is CVE-2025-22866?: Medium severity. CVSS v3 base score is 4.0 out of 10.
Is CVE-2025-22866 known to be exploited?: 5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.