HSEC-2025-0006 Private key leak via inherited file descriptor
An attacker with local access to spawn child processes can read private keys due to missing close-on-exec flags in the X.509 key reading function.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is HSEC-2025-0006?
HSEC-2025-0006 is a vulnerability in crypton-x509-store, published on 17 Nov 2025.
Official description
Private key leak via inherited file descriptor
The X.509 key reading function readKeyFile opened a file
descriptor to the private key without setting the close-on-exec
flag. If a child process is execed at the same time, it would
inherit that file descriptor and could read the private key
material.
Impact is limited to child processes that run untrusted code, but
that do not close inherited file descriptors. (For example, the
su(1) command.)
This leak was fixed by setting the close-on-exec flag on unix-based systems.
Which versions are affected by HSEC-2025-0006?
2 open source packages ship an affected version, including crypton-x509-store and x509-store.
| Package | Affected | Fixed in |
|---|---|---|
crypton-x509-store Hackage | From 1.6.9 | 1.6.12 |
x509-store Hackage | From 0.1 | None |
How do I fix HSEC-2025-0006?
Upgrade crypton-x509-store to 1.6.12 or later.
Is HSEC-2025-0006 being exploited?
There is no known exploitation of HSEC-2025-0006 in the wild and no public exploit code.