—

GO-2025-3749

Usage of ExtKeyUsageAny disables policy validation in crypto/x509

Quick fix

GO-2025-3749 — stdlib: upgrade to the fixed version with the command below.

go get stdlib@v1.24.4

Details

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go / stdlib

Introduced in: 1.24.0-0 Fixed in: 1.24.4

Fix go get stdlib@v1.24.4

References

https://go.dev/cl/670375 [FIX]
https://go.dev/issue/73612 [REPORT]
https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A [WEB]