PT-2025-11973 · Gnupg+5 · Gnupg+5
Dkg
·
Published
2025-02-10
·
Updated
2026-03-27
·
CVE-2025-30258
CVSS v3.1
4.7
Medium
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
GnuPG versions prior to 2.5.5
Description
The issue arises when a user imports a certificate with crafted subkey data lacking a valid backsig or having incorrect usage flags, leading to a loss of ability to verify signatures made from certain other signing keys. This can be considered a "verification DoS."
Recommendations
For GnuPG versions prior to 2.5.5, update to version 2.5.5 or later to resolve the issue.
Exploit
Fix
DoS
Improper Check for Exceptional Conditions
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Gnupg
Linuxmint
Red Os
Suse
Ubuntu