CVE-2025-6224: Go Hash Sum Api Misuse Leak
Calling `.Sum(data)` directly on a newly created `hash.Hash` without calling `.Write()` does not hash `data`. Instead, it computes the hash of an empty string and appends it to `data`. This unintentionally embeds and leaks `data` in plaintext. If `data` is a sensitive value like a private key, this compromises cryptographic secrets. To hash data correctly, e
Gogreprules fetch cve-2025-6224-go-hash-sum-api-misuse-leak --engine opengrepDescription
Calling `.Sum(data)` directly on a newly created `hash.Hash` without calling `.Write()` does not hash `data`. Instead, it computes the hash of an empty string and appends it to `data`. This unintentionally embeds and leaks `data` in plaintext. If `data` is a sensitive value like a private key, this compromises cryptographic secrets. To hash data correctly, e
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.