Vulnerability GO-2025-3447
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
1 year ago
February 06, 2025 at 04:38 PM UTC
Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec
<1.22.12, >=1.23.0-0 <1.23.6, >=1.24.0-0 <1.24.0-rc.3
<1.22.12, >=1.23.0-0 <1.23.6, >=1.24.0-0 <1.24.0-rc.3
Summary
Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec
Details
Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private key when P-256 is used in any well known protocols.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
2 days ago
HTTP/1 server crash due to MaxBytesReader header race in net/http
<1.26.11, >=1.27.0-0 <1.27.4 GO-2026-6859
<1.26.11, >=1.27.0-0 <1.27.4 GO-2026-6859
Unknown
23 days ago
Distrust compromised intermediate certificates in crypto/x509
<1.26.10, >=1.27.0-0 <1.27.3 GO-2026-6809
<1.26.10, >=1.27.0-0 <1.27.3 GO-2026-6809
Unknown
1 month ago
Reset context tracking on consecutive template expressions in html/template
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6599
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6599
Unknown
1 month ago
Recognize yield as regexp preceder keyword in html/template
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6600
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6600
Unknown
1 month ago
HTTP/2 server memory exhaustion due to Trailer headers in net/http
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6603
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6603
Impacted packages
Timeline
Published
1 year ago
February 06, 2025 at 04:38 PM UTC
Last Modified
1 hour ago
November 13, 2026 at 07:12 PM UTC