PT-2026-21615 · Crates.Io · Pgp

Publicado 2026-02-13 · Atualizado 2026-02-13

OSV

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Summary

Previous rPGP versions could be caused to crash with a "stack overflow" when parsing messages that contain deeply nested message layers, such as messages with many signatures.

rPGP 0.19.0 resolves this issue with a more robust message handling implementation (via https://github.com/rpgp/rpgp/pull/625).

Impact

An attacker could cause applications to crash in rPGP's message parsing subsystem, when applications attempt to ingest messages.

Attribution

Discovered internally during rPGP development, using a fuzz test suite previously contributed by Christian Reitter.

Correção

Stack Overflow

Enumeração de Fraquezas

CWE-121

Identificadores relacionados

GHSA-8H58-W33P-WQ3G

Produtos afetados

Pgp

Referências · 5

• https://github.com/rpgp/rpgp/commit/e82f2c7494ba277d62fd372d69b2c008473bbef8 · Nota
• https://github.com/rpgp/rpgp/pull/625 · Nota
• https://github.com/rpgp/rpgp · Nota
• https://github.com/rpgp/rpgp/security/advisories/GHSA-8h58-w33p-wq3g · Nota
• https://osv.dev/vulnerability/GHSA-8h58-w33p-wq3g · Aviso do Fabricante