evervault evervault-go up to 1.3.1 TLS Certificate signature verification

Summaryinfo

A vulnerability has been found in evervault evervault-go up to 1.3.1 and classified as problematic. This affects an unknown part of the component TLS Certificate Handler. The manipulation leads to signature verification. This vulnerability is traded as CVE-2025-64186. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in evervault evervault-go up to 1.3.1. It has been rated as problematic. This issue affects an unknown part of the component TLS Certificate Handler. The manipulation with an unknown input leads to a signature verification vulnerability. Using CWE to declare the problem leads to CWE-347. The product does not verify, or incorrectly verifies, the cryptographic signature for data. Impacted is integrity. The summary by CVE is:

Evervault is a payment security solution. A vulnerability was identified in the `evervault-go` SDK’s attestation verification logic in versions of `evervault-go` prior to 1.3.2 that may allow incomplete documents to pass validation. This may cause the client to trust an enclave operator that does not meet expected integrity guarantees. The exploitability of this issue is limited in Evervault-hosted environments as an attacker would require the pre-requisite ability to serve requests from specific evervault domain names, following from our ACME challenge based TLS certificate acquisition pipeline. The vulnerability primarily affects applications which only check PCR8. Though the efficacy is also reduced for applications that check all PCR values, the impact is largely remediated by checking PCR 0, 1 and 2. The identified issue has been addressed in version 1.3.2 by validating attestation documents before storing in the cache, and replacing the naive equality checks with a new SatisfiedBy check. Those who useevervault-go to attest Enclaves that are hosted outside of Evervault environments and cannot upgrade have two possible workarounds available. Modify the application logic to fail verification if PCR8 is not explicitly present and non-empty and/or add custom pre-validation to reject documents that omit any required PCRs.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2025-64186 since 10/28/2025. The exploitation is known to be easy. The attack may be initiated remotely. Additional levels of successful authentication are needed for exploitation. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 1.3.2 eliminates this vulnerability. Applying the patch 7c824d289bba11ec0bea46a338023f5b128bbb28 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-131929). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• evervault

Name

• evervault-go

Version

• 1.3.0
• 1.3.1

License

• open-source

Website

• Product: https://github.com/evervault/evervault-go/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion