CVE-2026-24883

In GnuPG before 2.5.17, a long signature packet length causes parsesignature to return success with sig-data set to a NULL value, leading to a denial of service application crash...

EUVD-2026-4770

In GnuPG before 2.5.17, a long signature packet length causes parsesignature to return success with sig-data set to a NULL value, leading to a denial of service application crash...

GNUPG code-related vulnerabilities

GNU Public Key Exchange GNUPG is a set of open-source encryption software from the GNU community in the United States, licensed under the GNU General Public License. This software supports algorithms such as public keys, symmetric encryption, and hashing. Versions of GnuPG prior to 2.5.17 had cod...

PT-2020-22402

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description A heap-use-after-free READ 4 crash has been reported. The crash involves the proc plaintext, do proc packets, and proc signature packets functions...

GHSA-HFMF-Q43V-2FFJ Improper Key Verification in openpgp

Versions of openpgp prior to 4.2.0 are vulnerable to Improper Key Verification. The OpenPGP standard allows signature packets to have subpackets which may be hashed or unhashed. Unhashed subpackets are not cryptographically protected and cannot be trusted. The openpgp package does not verify...