~ / search / GHSA-29c6-3hcj-89cf

GHSA-29c6-3hcj-89cf

go-crypto-winnative BCryptGenerateSymmetricKey memory leak

Source: GitHub Advisory Database (reviewed) High CVE-2025-25199

Packages

EcosystemPackageAffectedFixed in
Go github.com/microsoft/go-crypto-winnative < 0.0.0-20250211154640-f49c8e1379ea 0.0.0-20250211154640-f49c8e1379ea

Details

As written in the advisory (Markdown source, shown as plain text).

Calls to `cng.TLS1PRF` don't release the key handle, producing a small memory leak every time.

References

External links from the advisory. They lead to third-party sites.