Every CVE Search/ Get API key

CVE-2013-4402

The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote...

5.0 MediumFix available

The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.

Exploit likelihood

5.03%Up 2.9 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.

Record
CVE-2013-4402
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.

Record
CVE-2013-4402
Updated
2026-11-02
EUVDEUVD-2013-4281 No score

The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.

Record
EUVD-2013-4281
Updated
2026-11-03
GitHub AdvisoriesGHSA-fhrq-6wcr-78q4 No score

The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote...

The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.

Record
GHSA-fhrq-6wcr-78q4
Weakness
CWE-20
Updated
2026-11-02
OSV No score

The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.

Record
CVE-2013-4402
Updated
2026-11-02
OSVDEBIAN-CVE-2013-4402 No score

The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.

Record
DEBIAN-CVE-2013-4402
Updated
2026-11-02
OSVMGASA-2013-0299 No score

Updated gnupg2 packages fix multiple vulnerabilities

Updated gnupg2 package fixes security vulnerabilities:

RFC 4880 permits OpenPGP keyholders to mark their primary keys and subkeys with a "key flags" packet that indicates the capabilities of the key. These are represented as a set of binary flags, including things like "This key may be used to encrypt communications." If a key or subkey has this "key flags" subpacket attached with all bits cleared (off), GnuPG currently treats the key as having all bits set (on). While keys with this sort of marker are very rare in the wild, GnuPG's misinterpretation of this subpacket could lead to a breach of confidentiality or a mistaken identity verification (CVE-2013-4351).

Special crafted input data may be used to cause a denial of service against GPG. GPG can be forced to recursively parse certain parts of OpenPGP messages ad infinitum (CVE-2013-4402).

Record
MGASA-2013-0299
Updated
2026-11-02
OSVMGASA-2013-0303 No score

Updated gnupg packages fix CVE-2013-4402

Updated gnupg package fixes security vulnerability:

Special crafted input data may be used to cause a denial of service against GPG. GPG can be forced to recursively parse certain parts of OpenPGP messages ad infinitum (CVE-2013-4402).

Record
MGASA-2013-0303
Updated
2026-11-02
OSVopenSUSE-SU-2024:10102-1 No score

gpg2-2.1.16-1.1 on GA media

These are all security issues fixed in the gpg2-2.1.16-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10102-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gnupg2
Debian:12
 before 2.0.22-1
2.0.22-1
gnupg2
Debian:13
 before 2.0.22-1
2.0.22-1
gnupg2
Debian:14
 before 2.0.22-1
2.0.22-1
gnupg
Debian:6.0
From an advisory covering 2 CVEs
 before 1.4.10-4+squeeze3, plus listed versions
1.4.10-41.4.10-4+squeeze11.4.10-4+squeeze2
1.4.10-4+squeeze3
gnupg
Debian:7
From an advisory covering 2 CVEs
 before 1.4.12-7+deb7u2, plus listed versions
1.4.12-71.4.12-7+deb7u1
1.4.12-7+deb7u2
gnupg2
Debian:6.0
From an advisory covering 2 CVEs
 before 2.0.14-2+squeeze2, plus listed versions
2.0.14-22.0.14-2+squeeze1
2.0.14-2+squeeze2
gnupg2
Debian:7
From an advisory covering 2 CVEs
 before 2.0.19-2+deb7u1, plus listed versions
2.0.19-2
2.0.19-2+deb7u1
gnupg2
Mageia:2
From an advisory covering 2 CVEs
 before 2.0.18-1.4.mga2
2.0.18-1.4.mga2
gnupg2
Mageia:3
From an advisory covering 2 CVEs
 before 2.0.19-3.2.mga3
2.0.19-3.2.mga3
gnupg
Mageia:2
 before 1.4.12-1.3.mga2
1.4.12-1.3.mga2
Show 22 moreShow less
Affected packages
PackageAffectedFixed
gnupg
Mageia:3
 before 1.4.14-1.1.mga3
1.4.14-1.1.mga3
gnupg
Red Hat:enterprise_linux:5::client
From an advisory covering 4 CVEs
 before 0:1.4.5-18.el5_10
0:1.4.5-18.el5_10
gnupg-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 4 CVEs
 before 0:1.4.5-18.el5_10
0:1.4.5-18.el5_10
gnupg
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
 before 0:1.4.5-18.el5_10
0:1.4.5-18.el5_10
gnupg-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
 before 0:1.4.5-18.el5_10
0:1.4.5-18.el5_10
gnupg2
Red Hat:enterprise_linux:5::client
From an advisory covering 3 CVEs
 before 0:2.0.10-6.el5_10
0:2.0.10-6.el5_10
gnupg2-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 3 CVEs
 before 0:2.0.10-6.el5_10
0:2.0.10-6.el5_10
gnupg2
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
 before 0:2.0.10-6.el5_10
0:2.0.10-6.el5_10
gnupg2-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
 before 0:2.0.10-6.el5_10
0:2.0.10-6.el5_10
gnupg2
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
 before 0:2.0.14-6.el6_4
0:2.0.14-6.el6_4
gnupg2-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
 before 0:2.0.14-6.el6_4
0:2.0.14-6.el6_4
gnupg2-smime
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
 before 0:2.0.14-6.el6_4
0:2.0.14-6.el6_4
gnupg2
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
 before 0:2.0.14-6.el6_4
0:2.0.14-6.el6_4
gnupg2-debuginfo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
 before 0:2.0.14-6.el6_4
0:2.0.14-6.el6_4
gnupg2-smime
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
 before 0:2.0.14-6.el6_4
0:2.0.14-6.el6_4
gnupg2
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
 before 0:2.0.14-6.el6_4
0:2.0.14-6.el6_4
gnupg2-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
 before 0:2.0.14-6.el6_4
0:2.0.14-6.el6_4
gnupg2-smime
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
 before 0:2.0.14-6.el6_4
0:2.0.14-6.el6_4
gnupg2
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
 before 0:2.0.14-6.el6_4
0:2.0.14-6.el6_4
gnupg2-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
 before 0:2.0.14-6.el6_4
0:2.0.14-6.el6_4
gnupg2-smime
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
 before 0:2.0.14-6.el6_4
0:2.0.14-6.el6_4
gpg2
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 2.1.16-1.1
2.1.16-1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-4402 is a medium vulnerability (CVSS 5.0) in Gnupg, published October 9, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.03%, the 92nd percentile. Fixed in gnupg2 2.0.22-1.

References

Show 38 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open