CVE-2025-22866

MediumCVSS 4.0/10Last modified Jun 17, 2026

Description

Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private key when P-256 is used in any well known protocols.

Metrics

CVSS 3.1 4.0/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published
Feb 6, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-228677.5On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of CVE-2025-228687.5An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.CVE-2025-228697.5SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchangCVE-2025-22877.8A local code execution vulnerability exists in the Rockwell Automation Arena®  due to an uninitialized pointer. The flaw is result of impropCVE-2025-228704.4Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY enviroCVE-2025-228719.1The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling iCVE-2025-228726.5The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directlCVE-2025-228733.8It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../")CVE-2025-228747.5Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected cerCVE-2025-22887.8A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write outside of the allocCVE-2025-228807.8Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buCVE-2025-228817.8Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based bu
CVE-2025-22866: Medium severity, CVSS 4.0 | Vulnix