CVE-2025-6224: Go Hash Sum Api Misuse Leak
Calling `.Sum(data)` directly on a newly created `hash.Hash` without calling `.Write()` does not hash `data`. Instead, it computes the hash of an empty string and appends it to `data`. This unintentionally embeds and leaks `data` in plaintext. If `data` is a sensitive value like a private key, this compromises cryptographic secrets. To hash data correctly, e
Goβgreprules fetch cve-2025-6224-go-hash-sum-api-misuse-leak --engine opengrepDescription
Calling `.Sum(data)` directly on a newly created `hash.Hash` without calling `.Write()` does not hash `data`. Instead, it computes the hash of an empty string and appends it to `data`. This unintentionally embeds and leaks `data` in plaintext. If `data` is a sensitive value like a private key, this compromises cryptographic secrets. To hash data correctly, e
Community feedback
0 signals from signed-in users.
- Useful
- 0
- False positive
- 0
- Metadata
- 0