Memory leak in Go programming language - CVE-2025-22866

Vulnerability identifier: #VU103932

CSH Severity: Low

CVSS v4 BT: 0.4 [CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-22866

CWE-ID: CWE-401

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to a small number of bits of secret scalars are leaked on the ppc64le architecture in crypto/internal/nistec. A local user can gain access to potentially sensitive information.

Go programming language
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Enterprise Storage
Development Tools Module
openSUSE Leap
Ubuntu
IBM Concert Software
Netcool Operations Insight
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Cloud Pak for Business Automation
Submariner
IBM Observability with Instana
IBM Cloud Pak for Security
Red Hat Advanced Cluster Management for Kubernetes
Splunk Operator for Kubernetes Add-on
IBM MQ Operator
IBM Maximo Application Suite
IBM Business Automation Workflow
watsonx.data
Guardium Data Security Center (GDSC)
Storage Ceph
IBM Business Automation Manager Open Editions
Robotic Process Automation for Cloud Pak
Business Automation Insights
Red Hat OpenShift Serverless
OpenShift Service Mesh
golang-1.22 (Ubuntu package)
go1.22-openssl
go1.22-openssl-doc
go1.22-openssl-debuginfo
go1.22-openssl-race
go1.22-doc
go1.22-race
go1.22
go1.23-doc
go1.23-race
go1.23
go1.23-openssl-doc
go1.23-openssl-debuginfo
go1.23-openssl
go1.23-openssl-race
go1.24-doc
go1.24-race
go1.24
Red Hat Ceph Storage

Install updates from vendor's website.

Go programming language - addressed in versions 1.22.12, 1.23.6, 1.24 rc.3
IBM Concert Software - update to 1.1.0
Netcool Operations Insight - update to 1.6.15
watsonx.data - update to 2.2.1
Guardium Data Security Center (GDSC) - update to 3.8.1
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.2.0
Storage Ceph - update to 8.1z3
IBM Business Automation Manager Open Editions - update to 8.0.8
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.21, 23.0.20.3
Business Automation Insights - addressed in versions 24.0.0.0.4, 24.0.1.0.4
IBM Cloud Pak for Business Automation - addressed in versions 24.0.1-IF006, 25.0.0-IF003
Submariner - update to 0.18.5
Red Hat OpenShift Serverless - update to 1
IBM Observability with Instana - update to 1.0.295
IBM Cloud Pak for Security - update to 1.11.2.0
golang-1.22 (Ubuntu package) - addressed in versions 1.22.2-2ubuntu0.4, 1.22.2-2~22.04.3, 1.22.8-1ubuntu0.1
go1.22-openssl - update to 1.22.12-150000.1.12.1
go1.22-openssl-doc - update to 1.22.12-150000.1.12.1
go1.22-openssl-debuginfo - update to 1.22.12-150000.1.12.1
go1.22-openssl-race - update to 1.22.12-150000.1.12.1
go1.22-doc - update to 1.22.12-150000.1.42.1
go1.22-race - update to 1.22.12-150000.1.42.1
go1.22 - update to 1.22.12-150000.1.42.1
go1.23-doc - update to 1.23.6-150000.1.21.1
go1.23-race - update to 1.23.6-150000.1.21.1
go1.23 - update to 1.23.6-150000.1.21.1
go1.23-openssl-doc - addressed in versions 1.23.9-150000.1.9.1, 1.23.12-150600.13.9.1
go1.23-openssl-debuginfo - addressed in versions 1.23.9-150000.1.9.1, 1.23.12-150600.13.9.1
go1.23-openssl - addressed in versions 1.23.9-150000.1.9.1, 1.23.12-150600.13.9.1
go1.23-openssl-race - addressed in versions 1.23.9-150000.1.9.1, 1.23.12-150600.13.9.1
go1.24-doc - update to 1.24 rc3-150000.1.6.1
go1.24-race - update to 1.24 rc3-150000.1.6.1
go1.24 - update to 1.24 rc3-150000.1.6.1
OpenShift Service Mesh - update to 2.5.10
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.11.7, 2.13.4
Splunk Operator for Kubernetes Add-on - update to 3.0.0
IBM MQ Operator - addressed in versions 3.2.12, 3.5.3, 9.4.2.1-r2
Red Hat Ceph Storage - update to 7.1
IBM Maximo Application Suite - addressed in versions 8.10.24, 8.11.21, 9.0.10
IBM Business Automation Workflow - addressed in versions 24.0.0-IF005, 24.0.1-IF002

• https://go.dev/cl/643735
• https://go.dev/issue/71383
• https://groups.google.com/g/golang-announce/c/xU1ZCHUZw3k
• https://pkg.go.dev/vuln/GO-2025-3447

• Multiple vulnerabilities in Go programming language
• SUSE update for go1.23
• SUSE update for go1.22
• SUSE update for go1.24
• Multiple vulnerabilities in IBM Maximo Application Suite
• Multiple vulnerabilities in OpenShift Service Mesh 2.5
• Multiple vulnerabilities in IBM Cloud Pak for Security
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.11
• Multiple vulnerabilities in Red Hat Ceph Storage 7
• Multiple vulnerabilities in Submariner 0.18
• SUSE update for go1.22-openssl
• Multiple vulnerabilities in IBM MQ Operator
• Multiple vulnerabilities in IBM Observability with Instana (OnPrem)
• SUSE update for go1.23-openssl
• Multiple vulnerabilities in IBM Concert Software
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• IBM Watson Speech Services Cartridge for Golang crypto/internal/nistec
• Ubuntu update for golang-1.22
• Multiple vulnerabilities in IBM Business Automation Insights
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in IBM Guardium Data Security Center
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• IBM watsonx.data update for Go nistec
• SUSE update for go1.23-openssl
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.13
• Splunk Operator for Kubernetes Add-on update for third-party components
• Multiple vulnerabilities in Netcool Operations Insight
• IBM Storage Ceph update for Grafana
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation