News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway

CVE-2025-58188 CVE High · CVSS 7.5 Low Impact

crypto/x509: Panic on Certificate Validation with DSA Public Keys

Limited exploitability

Exploiting this vulnerability requires an uncommon setup or configuration. Upgrading is still recommended when possible.

Affects deployments validating TLS certificate chains that include DSA public keys. DSA certificates are extremely rare in modern PKI; most deployments use RSA or ECDSA and are not exposed to this crash path.

Component

Go standard library (crypto/x509)

Disclosed

Oct 8, 2025

CVSS Score

7.5

Description

Go’s crypto/x509 package panics when validating a certificate chain that contains a DSA public key, due to a missing interface implementation check. An attacker who can supply or influence a certificate chain presented during TLS handshake can crash any program that validates arbitrary certificate chains. Fixed in Go 1.24.8 and Go 1.25.2.

Version summary

Community Edition

2.11.1

addresses this advisory

Affected CE versions

>= 2.0, < 2.11.1

Enterprise Edition

2.11.2

addresses this advisory

Affected EE versions

>= 2.0, < 2.11.2

Upgrade to the addressed version or later to remediate this vulnerability.

References

View CVE-2025-58188 on NVD

Stay up to date with KrakenD releases and important updates