https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T12:26:48.763710+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2024-53856 CVE-2024-53856 — rPGP Panics on Malformed Untrusted Input 2026-10-03T12:26:48.765424+00:00

Affected: rpgp

rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows an attacker to trigger rpgp crashes by providing crafted data. This vulnerability is fixed in 0.14.1.

 https://cve.radiocsirt.org/vuln/ghsa-9rmp-2568-59rv GHSA-9rmp-2568-59rv — rPGP Panics on Malformed Untrusted Input 2026-10-03T12:26:48.765475+00:00

Affected: crates.io: pgp

During a security audit, [Radically Open Security](https://www.radicallyopensecurity.com/) discovered several reachable edge cases which allow an attacker to trigger `rpgp` crashes by providing crafted data.

### Impact When processing malformed input, `rpgp` can run into Rust panics which halt the program.

This can happen in the following scenarios: * Parsing OpenPGP messages from binary or armor format * Decrypting OpenPGP messages via `decrypt_with_password()` * Parsing or converting public keys * Parsing signed cleartext messages from armor format * Using malformed private keys to sign or encrypt

Given the affected components, we consider most attack vectors to be reachable by remote attackers during typical use cases of the `rpgp` library. The attack complexity is low since the malformed messages are generic, short, and require no victim-specific knowledge.

The result is a denial-of-service impact via program termination. There is no impact to confidentiality or integrity security properties.

### Versions and Patches All recent versions are affected by at least some of the above mentioned issues.

The vulnerabilities have been fixed with version `0.14.1`. We recommend all users to upgrade to this version.

### References

The security audit was made possible by the [NLnet Foundation NGI Zero Core](https://nlnet.nl/core/) grant program [for rpgp](https://nlnet.nl/project/rPGP-cryptorefresh/).