CVE-2025-25199: Missing Release of Memory after Effective Lifetime

go-crypto-winnative Go crypto backend for Windows using Cryptography API: Next Generation CNG. Prior to commit f49c8e1379ea4b147d5bff1b3be5b0ff45792e41, calls to cng.TLS1PRF don't release the key handle, producing a small memory leak every time. Commit f49c8e1379ea4b147d5bff1b3be5b0ff45792e41...

Microsoft go-crypto-winnative 安全漏洞

Microsoft go-crypto-winnative is a library from Microsoft Corporation USA. A security vulnerability exists in go-crypto-winnative, which stems from a call to cng.TLS1PRF that does not release the key handle, creating a small memory leak each time...

Memory Leak

github.com/golang-fips/openssl and github.com/microsoft/go-crypto-openssl are vulnerable to Memory Leak. The vulnerability is due to the mishandling of non-compliant RSA keys during encryption and verification, leading to a gradual depletion of available memory, which can result in a system crash...