# CVE-2025-22874: Usage of ExtKeyUsageAny disables policy validation in crypto/x509 CVE-2025-22874 is fixed in 43 products on 1 platform, first by SUSE-SU-2025:01846-1, released June 9, 2025. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2025-22874 - Priority: High - CVSS: 7.5 (Important) - EPSS: 0.0038 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Jun 9, 2025 - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-22874 ## Description Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | amazon-cloudwatch-agent amzn 2023 | 1.300055.3-1.amzn2023 | [ALAS2023-2025-1029](https://patchblox.com/security/data/fix/linux/alas2023-2025-1029.md) | Jun 18, 2025 | | Linux | amazon-ecr-credential-helper amzn 2023 | 0.10.1-2.amzn2023 | [ALAS2023-2025-1214](https://patchblox.com/security/data/fix/linux/alas2023-2025-1214.md) | Oct 14, 2025 | | Linux | amazon-ssm-agent amzn 2023 | 3.3.3572.0-1.amzn2023 | [ALAS2023-2025-1359](https://patchblox.com/security/data/fix/linux/alas2023-2025-1359.md) | Jan 7, 2026 | | Linux | captree amzn 2023 | 2.73-1.amzn2023.0.3 | [ALAS2023-2025-1141](https://patchblox.com/security/data/fix/linux/alas2023-2025-1141.md) | Aug 5, 2025 | | Linux | captree-debuginfo amzn 2023 | 2.73-1.amzn2023.0.3 | [ALAS2023-2025-1141](https://patchblox.com/security/data/fix/linux/alas2023-2025-1141.md) | Aug 5, 2025 | | Linux | cni-plugins amzn 2023 | 1.7.1-1.amzn2023.0.2 | [ALAS2023-2025-1143](https://patchblox.com/security/data/fix/linux/alas2023-2025-1143.md) | Aug 6, 2025 | | Linux | cni-plugins-debuginfo amzn 2023 | 1.7.1-1.amzn2023.0.2 | [ALAS2023-2025-1143](https://patchblox.com/security/data/fix/linux/alas2023-2025-1143.md) | Aug 6, 2025 | | Linux | cni-plugins-debugsource amzn 2023 | 1.7.1-1.amzn2023.0.2 | [ALAS2023-2025-1143](https://patchblox.com/security/data/fix/linux/alas2023-2025-1143.md) | Aug 6, 2025 | | Linux | containerd amzn 2023 | 2.0.5-1.amzn2023.0.2 | [ALAS2023-2025-1077](https://patchblox.com/security/data/fix/linux/alas2023-2025-1077.md) | Jul 3, 2025 | | Linux | containerd-debuginfo amzn 2023 | 2.0.5-1.amzn2023.0.2 | [ALAS2023-2025-1077](https://patchblox.com/security/data/fix/linux/alas2023-2025-1077.md) | Jul 3, 2025 | | Linux | containerd-debugsource amzn 2023 | 2.0.5-1.amzn2023.0.2 | [ALAS2023-2025-1077](https://patchblox.com/security/data/fix/linux/alas2023-2025-1077.md) | Jul 3, 2025 | | Linux | containerd-stress amzn 2023 | 2.0.5-1.amzn2023.0.2 | [ALAS2023-2025-1077](https://patchblox.com/security/data/fix/linux/alas2023-2025-1077.md) | Jul 3, 2025 | | Linux | containerd-stress-debuginfo amzn 2023 | 2.0.5-1.amzn2023.0.2 | [ALAS2023-2025-1077](https://patchblox.com/security/data/fix/linux/alas2023-2025-1077.md) | Jul 3, 2025 | | Linux | docker amzn 2023 | 25.0.8-1.amzn2023.0.5 | [ALAS2023-2025-1074](https://patchblox.com/security/data/fix/linux/alas2023-2025-1074.md) | Jul 3, 2025 | | Linux | docker-debuginfo amzn 2023 | 25.0.8-1.amzn2023.0.5 | [ALAS2023-2025-1074](https://patchblox.com/security/data/fix/linux/alas2023-2025-1074.md) | Jul 3, 2025 | | Linux | docker-debugsource amzn 2023 | 25.0.8-1.amzn2023.0.5 | [ALAS2023-2025-1074](https://patchblox.com/security/data/fix/linux/alas2023-2025-1074.md) | Jul 3, 2025 | | Linux | ecs-init amzn 2023 | 1.96.0-1.amzn2023 | [ALAS2023-2025-1109](https://patchblox.com/security/data/fix/linux/alas2023-2025-1109.md) | Jul 21, 2025 | | Linux | go-toolset RHEL 9 | 0:1.24.4-1.el9_6 | [RHSA-2025:10676](https://patchblox.com/security/data/fix/linux/rhsa-2025-10676.md) | Jul 9, 2025 | | Linux | go1.24 opensuse-leap 15.6 | 1.24.4-150000.1.26.1 | [SUSE-SU-2025:01846-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-01846-1.md) | Jun 9, 2025 | | Linux | go1.24 sles 15.6 | 1.24.4-150000.1.26.1 | [SUSE-SU-2025:01846-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-01846-1.md) | Jun 9, 2025 | | Linux | go1.24 sles 15.7 | 1.24.4-150000.1.26.1 | [SUSE-SU-2025:01846-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-01846-1.md) | Jun 9, 2025 | | Linux | go1.24-openssl opensuse-leap 15.6 | 1.24.6-150600.13.9.1 | [SUSE-SU-2025:03158-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03158-1.md) | Sep 11, 2025 | | Linux | go1.24-openssl sles 15.6 | 1.24.6-150600.13.9.1 | [SUSE-SU-2025:03158-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03158-1.md) | Sep 11, 2025 | | Linux | go1.24-openssl sles 15.7 | 1.24.6-150600.13.9.1 | [SUSE-SU-2025:03158-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03158-1.md) | Sep 11, 2025 | | Linux | golang RHEL 10 | 1.24.4-1.el10_0 | [RHSA-2025:10677](https://patchblox.com/security/data/fix/linux/rhsa-2025-10677.md) | Jun 11, 2025 | | Linux | golang RHEL 9 | 0:1.24.4-1.el9_6 | [RHSA-2025:10676](https://patchblox.com/security/data/fix/linux/rhsa-2025-10676.md) | Jul 9, 2025 | | Linux | golang amzn 2023 | 1.24.4-1.amzn2023.0.1 | [ALAS2023-2025-1028](https://patchblox.com/security/data/fix/linux/alas2023-2025-1028.md) | Jun 18, 2025 | | Linux | golang-1.24 Debian 13.5 (trixie) | 1.24.4-1 | [DEBIAN-CVE-2025-22874](https://patchblox.com/security/data/fix/linux/debian-cve-2025-22874.md) | Jun 11, 2025 | | Linux | golang-bin RHEL 9 | 0:1.24.4-1.el9_6 | [RHSA-2025:10676](https://patchblox.com/security/data/fix/linux/rhsa-2025-10676.md) | Jul 9, 2025 | | Linux | golang-bin amzn 2023 | 1.24.4-1.amzn2023.0.1 | [ALAS2023-2025-1028](https://patchblox.com/security/data/fix/linux/alas2023-2025-1028.md) | Jun 18, 2025 | | Linux | golang-docs RHEL 9 | 0:1.24.4-1.el9_6 | [RHSA-2025:10676](https://patchblox.com/security/data/fix/linux/rhsa-2025-10676.md) | Jul 9, 2025 | | Linux | golang-docs almalinux 10 | 1.24.4-1.el10_0.alma.1 | [ALSA-2025:10677](https://patchblox.com/security/data/fix/linux/alsa-2025-10677.md) | Jul 9, 2025 | | Linux | golang-docs amzn 2023 | 1.24.4-1.amzn2023.0.1 | [ALAS2023-2025-1028](https://patchblox.com/security/data/fix/linux/alas2023-2025-1028.md) | Jun 18, 2025 | | Linux | golang-misc RHEL 9 | 0:1.24.4-1.el9_6 | [RHSA-2025:10676](https://patchblox.com/security/data/fix/linux/rhsa-2025-10676.md) | Jul 9, 2025 | | Linux | golang-misc almalinux 10 | 1.24.4-1.el10_0.alma.1 | [ALSA-2025:10677](https://patchblox.com/security/data/fix/linux/alsa-2025-10677.md) | Jul 9, 2025 | | Linux | golang-misc amzn 2023 | 1.24.4-1.amzn2023.0.1 | [ALAS2023-2025-1028](https://patchblox.com/security/data/fix/linux/alas2023-2025-1028.md) | Jun 18, 2025 | | Linux | golang-race RHEL 9 | 0:1.24.4-1.el9_6 | [RHSA-2025:10676](https://patchblox.com/security/data/fix/linux/rhsa-2025-10676.md) | Jul 9, 2025 | | Linux | golang-shared amzn 2023 | 1.24.4-1.amzn2023.0.1 | [ALAS2023-2025-1028](https://patchblox.com/security/data/fix/linux/alas2023-2025-1028.md) | Jun 18, 2025 | | Linux | golang-src RHEL 9 | 0:1.24.4-1.el9_6 | [RHSA-2025:10676](https://patchblox.com/security/data/fix/linux/rhsa-2025-10676.md) | Jul 9, 2025 | | Linux | golang-src almalinux 10 | 1.24.4-1.el10_0.alma.1 | [ALSA-2025:10677](https://patchblox.com/security/data/fix/linux/alsa-2025-10677.md) | Jul 9, 2025 | | Linux | golang-src amzn 2023 | 1.24.4-1.amzn2023.0.1 | [ALAS2023-2025-1028](https://patchblox.com/security/data/fix/linux/alas2023-2025-1028.md) | Jun 18, 2025 | | Linux | golang-tests RHEL 9 | 0:1.24.4-1.el9_6 | [RHSA-2025:10676](https://patchblox.com/security/data/fix/linux/rhsa-2025-10676.md) | Jul 9, 2025 | | Linux | golang-tests almalinux 10 | 1.24.4-1.el10_0.alma.1 | [ALSA-2025:10677](https://patchblox.com/security/data/fix/linux/alsa-2025-10677.md) | Jul 9, 2025 | | Linux | golang-tests amzn 2023 | 1.24.4-1.amzn2023.0.1 | [ALAS2023-2025-1028](https://patchblox.com/security/data/fix/linux/alas2023-2025-1028.md) | Jun 18, 2025 | | Linux | libcap amzn 2023 | 2.73-1.amzn2023.0.3 | [ALAS2023-2025-1141](https://patchblox.com/security/data/fix/linux/alas2023-2025-1141.md) | Aug 5, 2025 | | Linux | libcap-debuginfo amzn 2023 | 2.73-1.amzn2023.0.3 | [ALAS2023-2025-1141](https://patchblox.com/security/data/fix/linux/alas2023-2025-1141.md) | Aug 5, 2025 | | Linux | libcap-debugsource amzn 2023 | 2.73-1.amzn2023.0.3 | [ALAS2023-2025-1141](https://patchblox.com/security/data/fix/linux/alas2023-2025-1141.md) | Aug 5, 2025 | | Linux | libcap-devel amzn 2023 | 2.73-1.amzn2023.0.3 | [ALAS2023-2025-1141](https://patchblox.com/security/data/fix/linux/alas2023-2025-1141.md) | Aug 5, 2025 | | Linux | libcap-static amzn 2023 | 2.73-1.amzn2023.0.3 | [ALAS2023-2025-1141](https://patchblox.com/security/data/fix/linux/alas2023-2025-1141.md) | Aug 5, 2025 | | Linux | nerdctl amzn 2023 | 2.1.2-1.amzn2023.0.1 | [ALAS2023-2025-1075](https://patchblox.com/security/data/fix/linux/alas2023-2025-1075.md) | Jul 3, 2025 | | Linux | oci-add-hooks amzn 2023 | 0-0.1.20200504git268e3bb.amzn2023.0.5 | [ALAS2023-2025-1079](https://patchblox.com/security/data/fix/linux/alas2023-2025-1079.md) | Jul 3, 2025 | | Linux | oci-add-hooks-debuginfo amzn 2023 | 0-0.1.20200504git268e3bb.amzn2023.0.5 | [ALAS2023-2025-1079](https://patchblox.com/security/data/fix/linux/alas2023-2025-1079.md) | Jul 3, 2025 | | Linux | oci-add-hooks-debugsource amzn 2023 | 0-0.1.20200504git268e3bb.amzn2023.0.5 | [ALAS2023-2025-1079](https://patchblox.com/security/data/fix/linux/alas2023-2025-1079.md) | Jul 3, 2025 | | Linux | runc amzn 2023 | 1.2.6-1.amzn2023.0.1 | [ALAS2023-2025-1078](https://patchblox.com/security/data/fix/linux/alas2023-2025-1078.md) | Jul 3, 2025 | | Linux | runc-debuginfo amzn 2023 | 1.2.6-1.amzn2023.0.1 | [ALAS2023-2025-1078](https://patchblox.com/security/data/fix/linux/alas2023-2025-1078.md) | Jul 3, 2025 | | Linux | runc-debugsource amzn 2023 | 1.2.6-1.amzn2023.0.1 | [ALAS2023-2025-1078](https://patchblox.com/security/data/fix/linux/alas2023-2025-1078.md) | Jul 3, 2025 | | Linux | runfinch-finch amzn 2023 | 1.8.3-1.amzn2023.0.1 | [ALAS2023-2025-1073](https://patchblox.com/security/data/fix/linux/alas2023-2025-1073.md) | Jul 3, 2025 | | Linux | soci-snapshotter amzn 2023 | 0.9.0-1.amzn2023.0.4 | [ALAS2023-2025-1076](https://patchblox.com/security/data/fix/linux/alas2023-2025-1076.md) | Jul 3, 2025 | --- Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.