GHSA-c7ph-f7jm-xv4w
rPGP's integrity protection of encrypted data was not always checked
GHSA-c7ph-f7jm-xv4w is a medium vulnerability (CVSS 6.3) in pgp, published February 13, 2026. No source lists public exploit code. Fixed in pgp 0.19.0.
- Severity
- 6.3 MediumCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.19.0pgp
Description
Summary
For some messages, rPGP returned incorrectly decrypted data without signaling that integrity protection was invalid.
Details
When decrypting SEIPD (Symmetrically Encrypted and Integrity Protected Data Packet), rPGP previously did not under all circumstances report the absence of valid integrity protection to callers of the library.
Impact
While the resulting invalid decryption output is not attacker controlled, its contents may be a security concern if an attacker can gain access to it.
Attribution
Discovered internally in the course of rPGP development work.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pgpcrates.io | 0.16.0-alpha.0 up to 0.19.0 | 0.19.0 |
What each source reports
GitHub Advisories Score used
rPGP's integrity protection of encrypted data was not always checked
Summary
For some messages, rPGP returned incorrectly decrypted data without signaling that integrity protection was invalid.
Details
When decrypting SEIPD (Symmetrically Encrypted and Integrity Protected Data Packet), rPGP previously did not under all circumstances report the absence of valid integrity protection to callers of the library.
Impact
While the resulting invalid decryption output is not attacker controlled, its contents may be a security concern if an attacker can gain access to it.
Attribution
Discovered internally in the course of rPGP development work.
- Record
GHSA-c7ph-f7jm-xv4w- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-354
- Updated
- 2026-11-02
OSV
rPGP's integrity protection of encrypted data was not always checked
Summary
For some messages, rPGP returned incorrectly decrypted data without signaling that integrity protection was invalid.
Details
When decrypting SEIPD (Symmetrically Encrypted and Integrity Protected Data Packet), rPGP previously did not under all circumstances report the absence of valid integrity protection to callers of the library.
Impact
While the resulting invalid decryption output is not attacker controlled, its contents may be a security concern if an attacker can gain access to it.
Attribution
Discovered internally in the course of rPGP development work.
- Record
GHSA-c7ph-f7jm-xv4w- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-354
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.