{"cve":"CVE-2025-22866","nvd":{"published":"2025-02-06T17:15:21.410","modified":"2026-06-17T08:50:38.563","status":"Deferred","description":"Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private key when P-256 is used in any well known protocols.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":4.0},"cwes":[],"references":["https://go.dev/cl/643735","https://go.dev/issue/71383","https://groups.google.com/g/golang-announce/c/xU1ZCHUZw3k","https://pkg.go.dev/vuln/GO-2025-3447","https://security.netapp.com/advisory/ntap-20250221-0002/"],"products":[],"source":"nvd","synced_at":"2026-10-19T21:59:18.731010617+00:00"},"epss":{"cve":"CVE-2025-22866","score":0.0029,"percentile":0.21563,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GO-2025-3447","url":"https://osv.dev/vulnerability/GO-2025-3447","summary":"Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec","modified":"2026-09-29T10:56:43.168873902Z","packages":[{"ecosystem":"Go","name":"stdlib","purl":"pkg:golang/stdlib","ranges":["<1.22.12",">=1.23.0-0 <1.23.6",">=1.24.0-0 <1.24.0-rc.3"],"fixed":["1.22.12","1.23.6","1.24.0-rc.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}