AZL-72104 CVE-2025-22874 affecting package golang for versions less than 1.24.4-1

🗓️ 11 Jun 2025 17:15:42Reported by GoogleType

osv🔗 osv.dev👁 5 Views

Golang versions under 1.24.4-1 disable policy validation when Verify uses ExtKeyUsageAny with policy graphs.

Reporter	Title	Published	Views	Family All 566
ibm	Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images	25 Sep 202506:49	–	ibm
ibm	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.	22 Dec 202509:22	–	ibm
ibm	Security Bulletin: IBM Instana Observability has addressed Multiple Vulnerabilities within Instana Agent container image	16 Sep 202509:57	–	ibm
ibm	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.	28 Oct 202505:59	–	ibm
ibm	Security Bulletin: IBM Maximo Application Suite uses net/http 1.23.4,1.24.2,1.24.3,crypto/x509 1.24.2,1.24.3 which is vulnerable to CVE-2025-4673, CVE-2025-22874.	24 Feb 202606:11	–	ibm
ibm	Security Bulletin: Multiple security vulnerabilities in Go affects IBM Robotic Process Automation for Cloud Pak	16 Oct 202521:07	–	ibm
ibm	Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality [CVE-2025-22874]	6 Aug 202511:17	–	ibm
ibm	Security Bulletin: Multiple vulnerabilities in IBM Watsonx BI Assistant for CP4D	15 Dec 202515:39	–	ibm
ibm	Security Bulletin: ELM on Hybrid Cloud vulnerabilities addressed in 2.0.0	20 Apr 202609:57	–	ibm
ibm	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses crypto/x509 which is vulnerable to this CVE-2025-22874	15 Sep 202507:56	–	ibm

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-22874

21 Apr 2026 04:36Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.17.5

EPSS0.00311

SSVC