Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-42784

Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat Sequoia-pgp
Products
Enterprise Linux Ansible Automation Platform Ansible Automation Platform Developer and 15 more
CVE-2023-53160

sequoia-openpgp: Sequoia OpenPGP Array Access Panic

The sequoia-openpgp crate before 1.16.0 for Rust allows out-of-bounds array access and a panic.

CVSS 3.1 · 2.9 Low EPSS < 1% KEV · Not listed
Vendors
Sequoia-pgp
Products
Sequoia-openpgp
CVE-2024-58261

sequoia-openpgp: Sequoia OpenPGP: RawCertParser Infinite Loop Vulnerability

The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of "Reading a cert: Invalid operation: Not a Key packet" messages for RawCertParser operations that encounter an unsupported primary key type.

CVSS 3.1 · 2.9 Low EPSS < 1% KEV · Not listed
Vendors
Sequoia-pgp
Products
Sequoia-openpgp