HSEC-2025-0006
Private key leak via inherited file descriptor
Private key leak via inherited file descriptor
The X.509 key reading function readKeyFile opened a file
descriptor to the private key without setting the close-on-exec
flag. If a child process is execed at the same time, it would
inherit that file descriptor and could read the private key
material.
Impact is limited to child processes that run untrusted code, but
that do not close inherited file descriptors. (For example, the
su(1) command.)
This leak was fixed by setting the close-on-exec flag on unix-based systems.
What each source reports
OSV No score
Private key leak via inherited file descriptor
Private key leak via inherited file descriptor
The X.509 key reading function readKeyFile opened a file
descriptor to the private key without setting the close-on-exec
flag. If a child process is execed at the same time, it would
inherit that file descriptor and could read the private key
material.
Impact is limited to child processes that run untrusted code, but
that do not close inherited file descriptors. (For example, the
su(1) command.)
This leak was fixed by setting the close-on-exec flag on unix-based systems.
- Record
HSEC-2025-0006- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
x509-storeHackage |
0.1 and later, plus listed versions 1.4.01.4.11.4.21.4.31.4.4 Show 11 moreShow less1.5.01.6.01.6.11.6.21.6.31.6.41.6.51.6.61.6.71.6.81.6.9 |
None known |
crypton-x509-storeHackage |
1.6.9 up to 1.6.12, plus listed versions 1.6.101.6.11 |
1.6.12 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
HSEC-2025-0006 is a vulnerability with no CVSS score yet in x509-store, published November 17, 2025. No source lists public exploit code. Fixed in crypton-x509-store 1.6.12.