PT-2026-21615 · Crates.Io · Pgp

Published 2026-02-13 · Updated 2026-02-13

OSV

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Summary

Previous rPGP versions could be caused to crash with a "stack overflow" when parsing messages that contain deeply nested message layers, such as messages with many signatures.

rPGP 0.19.0 resolves this issue with a more robust message handling implementation (via https://github.com/rpgp/rpgp/pull/625).

Impact

An attacker could cause applications to crash in rPGP's message parsing subsystem, when applications attempt to ingest messages.

Attribution

Discovered internally during rPGP development, using a fuzz test suite previously contributed by Christian Reitter.

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

GHSA-8H58-W33P-WQ3G

Affected Products

Pgp

References · 5

• https://osv.dev/vulnerability/GHSA-8h58-w33p-wq3g · Vendor Advisory
• https://github.com/rpgp/rpgp/commit/e82f2c7494ba277d62fd372d69b2c008473bbef8 · Note
• https://github.com/rpgp/rpgp/pull/625 · Note
• https://github.com/rpgp/rpgp · Note
• https://github.com/rpgp/rpgp/security/advisories/GHSA-8h58-w33p-wq3g · Note