{"id":"CVE-2022-3219","aliases":["CLSA-2026-1780512159","DEBIAN-CVE-2022-3219","EUVD-2022-42633","GHSA-pf7g-97vv-qmrr","UBUNTU-CVE-2022-3219"],"status":"published","title":"GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with...","description":"GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.","severity":{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00293,"percentile":0.22047,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2023-02-23T00:00:00Z","modified":"2026-10-26T09:31:05Z","fixes":[{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"gnupg2","fixed_in":["2.3.3-4.el9_6.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"gnupg2-smime","fixed_in":["2.3.3-4.el9_6.tuxcare.els4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-4.el9_6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gnupg2-smime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-4.el9_6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.40-1.1","2.2.40-1.1+deb12u1","2.2.40-1.1+deb12u2","2.2.40-1.1+hurd.1","2.2.40-1.1+loong64","2.2.40-2","2.2.40-3","2.2.43-1","2.2.43-2","2.2.43-3","2.2.43-4","2.2.43-5","2.2.43-6","2.2.43-7","2.2.43-8","2.2.44-1","2.2.45-1","2.2.45-2","2.2.45-3","2.2.46-1","2.2.46-2","2.2.46-3","2.2.46-4","2.2.46-5","2.2.46-6","2.2.46~pre1-1","2.3.1-1","2.4.3-2","2.4.4-1","2.4.4-2","2.4.4-3","2.4.4-4","2.4.5-1","2.4.5-2","2.4.5-3","2.4.6-1","2.4.7-1","2.4.7-10","2.4.7-11","2.4.7-12","2.4.7-13","2.4.7-14","2.4.7-15","2.4.7-16","2.4.7-17","2.4.7-18","2.4.7-19","2.4.7-2","2.4.7-20","2.4.7-21","2.4.7-3","2.4.7-4","2.4.7-5","2.4.7-6","2.4.7-7","2.4.7-8","2.4.7-9","2.4.8-1","2.4.8-2","2.4.8-3","2.4.8-4","2.4.8-5","2.4.8-6","2.4.9-1","2.4.9-2","2.4.9-3","2.4.9-4","2.4.9-5","2.4.9-6","2.4.9-7","2.4.9-8"]},{"source":"osv","ecosystem":"Debian:13","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-21","2.4.7-21+deb13u1","2.4.8-1","2.4.8-2","2.4.8-3","2.4.8-4","2.4.8-5","2.4.8-6","2.4.9-1","2.4.9-2","2.4.9-3","2.4.9-4","2.4.9-5","2.4.9-6","2.4.9-7","2.4.9-8"]},{"source":"osv","ecosystem":"Debian:14","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-21","2.4.8-1","2.4.8-2","2.4.8-3","2.4.8-4","2.4.8-5","2.4.8-6","2.4.9-1","2.4.9-2","2.4.9-3","2.4.9-4","2.4.9-5","2.4.9-6","2.4.9-7","2.4.9-8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.14-1ubuntu2","1.4.15-1.1ubuntu1","1.4.15-1.1ubuntu2","1.4.15-2ubuntu1","1.4.16-1ubuntu1","1.4.16-1ubuntu2","1.4.16-1ubuntu2.1","1.4.16-1ubuntu2.3","1.4.16-1ubuntu2.4","1.4.16-1ubuntu2.5","1.4.16-1ubuntu2.6","1.4.16-1ubuntu2.6+esm1","1.4.16-1ubuntu2.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.18-7ubuntu1","1.4.19-6ubuntu1","1.4.20-1ubuntu1","1.4.20-1ubuntu2","1.4.20-1ubuntu3","1.4.20-1ubuntu3.1","1.4.20-1ubuntu3.2","1.4.20-1ubuntu3.3","1.4.20-1ubuntu3.3+esm2","1.4.20-1ubuntu3.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.28-3ubuntu1","2.0.28-3ubuntu2","2.1.11-6ubuntu1","2.1.11-6ubuntu2","2.1.11-6ubuntu2.1","2.1.11-6ubuntu2.1+esm1","2.1.11-6ubuntu2.1+esm2","2.1.11-6ubuntu2.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.15-1ubuntu8","2.2.4-1ubuntu1","2.2.4-1ubuntu1.1","2.2.4-1ubuntu1.2","2.2.4-1ubuntu1.3","2.2.4-1ubuntu1.4","2.2.4-1ubuntu1.5","2.2.4-1ubuntu1.6","2.2.4-1ubuntu1.6+esm1","2.2.4-1ubuntu1.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.12-1ubuntu3","2.2.17-3ubuntu1","2.2.19-3ubuntu2","2.2.19-3ubuntu2.1","2.2.19-3ubuntu2.2","2.2.19-3ubuntu2.4","2.2.19-3ubuntu2.5","2.2.19-3ubuntu2.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.20-1ubuntu4","2.2.27-2ubuntu1","2.2.27-3ubuntu1","2.2.27-3ubuntu2","2.2.27-3ubuntu2.1","2.2.27-3ubuntu2.3","2.2.27-3ubuntu2.4","2.2.27-3ubuntu2.5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.40-1.1ubuntu1","2.4.4-2ubuntu7","2.4.4-2ubuntu15","2.4.4-2ubuntu16","2.4.4-2ubuntu17","2.4.4-2ubuntu17.2","2.4.4-2ubuntu17.3","2.4.4-2ubuntu17.4","2.4.4-2ubuntu17.6"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.4-2ubuntu23","2.4.4-2ubuntu24","2.4.7-17ubuntu3","2.4.8-2ubuntu1","2.4.8-2ubuntu2","2.4.8-2ubuntu2.1"]}],"products":[{"vendor":"gnupg","product":"gnupg"}],"references":[{"url":"https://dev.gnupg.org/D556","tags":["x_transferred","Patch","fix"]},{"url":"https://marc.info/?l=oss-security\u0026m=165696590211434\u0026w=4","tags":["x_transferred","Mailing List","Patch","article","fix","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-3219","tags":["x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2127010","tags":["x_transferred","Issue Tracking","Third Party Advisory","advisory","report"]},{"url":"https://dev.gnupg.org/T5993","tags":["x_transferred","Patch","fix"]},{"url":"https://security.netapp.com/advisory/ntap-20230324-0001/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3219","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20230324-0001"},{"url":"https://github.com/advisories/GHSA-pf7g-97vv-qmrr"},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1780512159.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-3219","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-3219","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3219","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-3219","description":"GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.","status":"published","published":"2023-02-23T00:00:00Z","modified":"2025-03-12T20:45:46.104Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"adp"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:34:32.843656Z"}],"euvd":[{"id":"EUVD-2022-42633","description":"GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.","status":"published","published":"2023-02-23T00:00:00Z","modified":"2025-03-12T20:45:46Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T20:53:05.95539Z"}],"ghsa":[{"id":"GHSA-pf7g-97vv-qmrr","title":"GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with...","description":"GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.","status":"published","published":"2023-02-23T21:30:17Z","modified":"2025-03-12T21:32:30Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:00:15.533946Z"}],"nvd":[{"id":"CVE-2022-3219","description":"GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.","status":"published","published":"2023-02-23T20:15:12.393Z","modified":"2026-06-17T04:59:05.937Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"primary"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:07:36.601381Z"}],"osv":[{"id":"CVE-2022-3219","description":"GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.","status":"published","published":"2023-02-23T20:15:12Z","modified":"2026-04-10T04:48:06.508781Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:44:25.860945Z"},{"id":"DEBIAN-CVE-2022-3219","description":"GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.","status":"published","published":"2023-02-23T20:15:12.393Z","modified":"2026-11-03T08:03:53.312092798Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-03T08:23:57.167851Z"},{"id":"UBUNTU-CVE-2022-3219","description":"GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.","status":"published","published":"2023-02-23T20:15:00Z","modified":"2026-09-03T16:01:18.582757638Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T16:53:54.697021Z"},{"id":"CLSA-2026-1780512159","title":"gnupg2: Fix of CVE-2022-3219","description":"- CVE-2022-3219: reject compressed key packets on import to fix a denial of\n  service from crafted compressed public keys (adds --compatibility-flags\n  compr-keys escape hatch)","status":"published","published":"2026-06-03T18:42:54Z","modified":"2026-10-26T09:31:05.63716983Z","updated_at":"2026-11-02T15:43:45.445699Z"}]}}