CVE-2025-64186

The CVE concerns the evervault-go SDK used for enclave attestation. A vulnerability in versions prior to 1.3.2 allowed incomplete attestation documents to pass validation, potentially causing a client to trust an enclave operator that does not meet integrity guarantees. The issue centers on insuf...

CVE-2025-64186 Evervault Go SDK: Incomplete PCR Validation in Enclave Attestation for non-Evervault hosted Enclaves

Evervault is a payment security solution. A vulnerability was identified in the evervault-go SDK’s attestation verification logic in versions of evervault-go prior to 1.3.2 that may allow incomplete documents to pass validation. This may cause the client to trust an enclave operator that does not...