CVE-2026-2625
Rust-rpm-sequoia: rust-rpm-sequoia: denial of service via crafted rpm file during signature verification
A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager (RPM) file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an unconditional termination of the rpm process. This issue results in an application level denial of service, making the system unable to process RPM files for signature verification.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Rust-rpm-sequoia: rust-rpm-sequoia: denial of service via crafted rpm file during signature verification
A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager (RPM) file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an unconditional termination of the rpm process. This issue results in an application level denial of service, making the system unable to process RPM files for signature verification.
- Record
CVE-2026-2625- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-347
- Updated
- 2026-11-05
EUVDEUVD-2026-18815
A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager (RPM) file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an unconditional termination of the rpm process. This issue results in an application level denial of service, making the system unable to process RPM files for signature verification.
- Record
EUVD-2026-18815- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-p6j6-g4fc-g496
A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a...
A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager (RPM) file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an unconditional termination of the rpm process. This issue results in an application level denial of service, making the system unable to process RPM files for signature verification.
- Record
GHSA-p6j6-g4fc-g496- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-347
- Updated
- 2026-11-04
NVD
A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager (RPM) file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an unconditional termination of the rpm process. This issue results in an application level denial of service, making the system unable to process RPM files for signature verification.
- Record
CVE-2026-2625- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-347
- Updated
- 2026-11-05
OSVALPINE-CVE-2026-2625
A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager (RPM) file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an unconditional termination of the rpm process. This issue results in an application level denial of service, making the system unable to process RPM files for signature verification.
- Record
ALPINE-CVE-2026-2625- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSVDEBIAN-CVE-2026-2625
A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager (RPM) file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an unconditional termination of the rpm process. This issue results in an application level denial of service, making the system unable to process RPM files for signature verification.
- Record
DEBIAN-CVE-2026-2625- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-04
OSVRHSA-2026:12682
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:12682- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-2625
A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager (RPM) file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an unconditional termination of the rpm process. This issue results in an application level denial of service, making the system unable to process RPM files for signature verification.
- Record
UBUNTU-CVE-2026-2625- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
py3-pysequoiaAlpine:v3.24 |
before 0.1.34-r0 | 0.1.34-r0 |
sequoia-chameleon-gnupgAlpine:v3.23 |
before 0.13.1-r1 | 0.13.1-r1 |
sequoia-chameleon-gnupgAlpine:v3.24 |
before 0.13.1-r2 | 0.13.1-r2 |
sequoia-sqAlpine:v3.23 |
before 1.3.1-r2 | 1.3.1-r2 |
sequoia-sqAlpine:v3.24 |
before 1.3.1-r4 | 1.3.1-r4 |
sequoia-sqvAlpine:v3.23 |
before 1.3.0-r1 | 1.3.0-r1 |
sequoia-sqvAlpine:v3.24 |
before 1.3.0-r2 | 1.3.0-r2 |
rust-rpm-sequoiaDebian:13 |
All versions, plus listed versions 1.10.0-11.10.1-11.10.1-21.10.2-11.10.3-11.8.0-21.9.0-1 |
None known |
rust-rpm-sequoiaDebian:14 |
before 1.10.2-1, plus listed versions 1.10.0-11.10.1-11.10.1-21.8.0-21.9.0-1 |
1.10.2-1 |
rpm-sequoiaRed Hat:hummingbird:1 |
before 0:1.10.1.1-1.2.hum1 | 0:1.10.1.1-1.2.hum1 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rpm-sequoia-develRed Hat:hummingbird:1 |
before 0:1.10.1.1-1.2.hum1 | 0:1.10.1.1-1.2.hum1 |
rust-rpm-sequoiaRed Hat:hummingbird:1 |
before 0:1.10.1.1-1.2.hum1 | 0:1.10.1.1-1.2.hum1 |
rust-rpm-sequoiaUbuntu:25.10 |
All versions, plus listed versions 1.7.0-31.8.0-2 |
None known |
rust-rpm-sequoiaUbuntu:26.10 |
All versions, plus listed versions 1.10.0-11.10.2-1 |
None known |
rust-rpm-sequoiaUbuntu:26.04:LTS |
All versions, plus listed versions 1.8.0-21.9.0-11.10.0-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts, references | CVE List | |
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-2625 is a medium vulnerability (CVSS 4.0) in Sequoia-pgp Rpm-sequoia, published April 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.09%, the 0th percentile. Fixed in py3-pysequoia 0.1.34-r0.
References
access.redhat.com/errata/RHSA-2026:12682
bugzilla.redhat.com/show_bug.cgi?id=2440357
nvd.nist.gov/vuln/detail/CVE-2026-2625
github.com/advisories/GHSA-p6j6-g4fc-g496
Show 7 moreShow less
security.alpinelinux.org/vuln/CVE-2026-2625
security-tracker.debian.org/tracker/CVE-2026-2625
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_12682.json
cve.org/CVERecord?id=CVE-2026-2625
ubuntu.com/security/CVE-2026-2625