https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T12:33:09.402807+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-373964 EUVD-2026-373964 2026-10-03T12:33:09.506497+00:00 EUVD-2026-373964 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42784 fkie_cve-2026-42784 2026-10-03T12:33:09.506537+00:00

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.

 https://cve.radiocsirt.org/vuln/ghsa-g33h-rrj9-75qv GHSA-g33h-rrj9-75qv 2026-10-03T12:33:09.506572+00:00

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-42784 msrc_CVE-2026-42784 — Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion 2026-10-03T12:33:09.506590+00:00 msrc_CVE-2026-42784 https://cve.radiocsirt.org/vuln/rhsa-2026:42902 RHSA-2026:42902 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update 2026-10-03T12:33:09.506608+00:00

sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-42784 UBUNTU-CVE-2026-42784 2026-10-03T12:33:09.506626+00:00

Affected: Ubuntu:22.04:LTS: rust-sequoia-openpgp, Ubuntu:24.04:LTS: rust-sequoia-openpgp, Ubuntu:25.10: rust-sequoia-openpgp, Ubuntu:26.04:LTS: rust-sequoia-openpgp

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.