Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2026-42784

Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat Sequoia-pgp
Products
Enterprise Linux Ansible Automation Platform Ansible Automation Platform Developer and 15 more
CVE-2026-2625

Rust-rpm-sequoia: rust-rpm-sequoia: denial of service via crafted rpm file during signature verification

A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager (RPM) file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an unconditional termination of the rpm process. This issue results in an application level denial of service, making the system unable to process RPM files for signature verification.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Rust-rpm-sequoia Sequoia-pgp
Products
Enterprise Linux Hardened Images Hummingbird and 2 more
CVE-2025-67897

Sequoia: Sequoia: Application crash via crafted encrypted message

In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a victim an encrypted message with a crafted PKESK or SKESK packet.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sequoia-pgp
Products
Sequoia
CVE-2023-53161

buffered-reader: Buffered-Reader Out-of-Bounds Access Vulnerability

The buffered-reader crate before 1.1.5 for Rust allows out-of-bounds array access and a panic.

CVSS 3.1 · 2.9 Low EPSS < 1% KEV · Not listed
Vendors
Sequoia-pgp
Products
Buffered-reader
CVE-2023-53160

sequoia-openpgp: Sequoia OpenPGP Array Access Panic

The sequoia-openpgp crate before 1.16.0 for Rust allows out-of-bounds array access and a panic.

CVSS 3.1 · 2.9 Low EPSS < 1% KEV · Not listed
Vendors
Sequoia-pgp
Products
Sequoia-openpgp
CVE-2024-58261

sequoia-openpgp: Sequoia OpenPGP: RawCertParser Infinite Loop Vulnerability

The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of "Reading a cert: Invalid operation: Not a Key packet" messages for RawCertParser operations that encounter an unsupported primary key type.

CVSS 3.1 · 2.9 Low EPSS < 1% KEV · Not listed
Vendors
Sequoia-pgp
Products
Sequoia-openpgp