CVE-2025-25199: go-crypto-winnative BCryptGenerateSymmetricKey memory leak

February 12, 2025

Calls to cng.TLS1PRF don’t release the key handle, producing a small memory leak every time.

References

github.com/advisories/GHSA-29c6-3hcj-89cf
github.com/microsoft/go-crypto-winnative
github.com/microsoft/go-crypto-winnative/commit/f49c8e1379ea4b147d5bff1b3be5b0ff45792e41
github.com/microsoft/go-crypto-winnative/security/advisories/GHSA-29c6-3hcj-89cf
nvd.nist.gov/vuln/detail/CVE-2025-25199

Code Behaviors & Features

Detect and mitigate CVE-2025-25199 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →