{"id":"CVE-2024-58261","aliases":["DEBIAN-CVE-2024-58261","EUVD-2024-54821","GHSA-9344-p847-qm5c","RUSTSEC-2024-0345","UBUNTU-CVE-2024-58261"],"status":"published","title":"Low severity (DoS) vulnerability in sequoia-openpgp","description":"The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of \"Reading a cert: Invalid operation: Not a Key packet\" messages for RawCertParser operations that encounter an unsupported primary key type.","severity":{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00428,"percentile":0.37289,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-835"],"published":"2024-06-26T12:00:00Z","modified":"2026-11-02T12:03:13Z","fixes":[{"ecosystem":"crates.io","package":"sequoia-openpgp","fixed_in":["1.21.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:13","package":"rust-sequoia-openpgp","fixed_in":["1.21.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rust-sequoia-openpgp","fixed_in":["1.21.0-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"sequoia-openpgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.0"},{"fixed":"1.21.0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rust-sequoia-openpgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rust-sequoia-openpgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.0-1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"sequoia-openpgp","ranges":[{"type":"SEMVER","events":[{"introduced":"1.13.0"},{"fixed":"1.21.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"sequoia-openpgp","ranges":[{"type":"SEMVER","events":[{"introduced":"1.13.0"},{"fixed":"1.21.0"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rust-sequoia-openpgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0-3","1.3.0-4","1.7.0-6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-sequoia-openpgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.0-1","1.17.0-1","1.17.0-2","1.18.0-1","1.19.0-1","1.19.0-1build1"]}],"products":[{"vendor":"sequoia-pgp","product":"sequoia"},{"vendor":"sequoia-pgp","product":"sequoia-openpgp"}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2024-0345.html","tags":["Third Party Advisory","advisory","web","report"]},{"url":"https://gitlab.com/sequoia-pgp/sequoia/-/issues/1106","tags":["exploit","Exploit","report","web"]},{"url":"https://crates.io/crates/sequoia-openpgp","tags":["Product","web","package","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58261","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9344-p847-qm5c"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58261.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-58261","tags":["advisory"]},{"url":"https://gitlab.com/sequoia-pgp/sequoia","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-58261","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-58261","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-58261","description":"The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of \"Reading a cert: Invalid operation: Not a Key packet\" messages for RawCertParser operations that encounter an unsupported primary key type.","status":"published","published":"2025-07-27T00:00:00Z","modified":"2025-07-28T18:55:28.197Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:34:08.843708Z"}],"euvd":[{"id":"EUVD-2024-54821","description":"The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of \"Reading a cert: Invalid operation: Not a Key packet\" messages for RawCertParser operations that encounter an unsupported primary key type.","status":"published","published":"2025-07-27T00:00:00Z","modified":"2025-07-28T18:55:28Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T20:32:03.359865Z"}],"ghsa":[{"id":"GHSA-9344-p847-qm5c","title":"Low severity (DoS) vulnerability in sequoia-openpgp","description":"There is a denial-of-service vulnerability in sequoia-openpgp, our crate providing a low-level interface to our OpenPGP implementation. When triggered, the process will enter an infinite loop.\n\nMany thanks to Andrew Gallagher for disclosing the issue to us.\n\n## Impact\n\nAny software directly or indirectly using the interface `sequoia_openpgp::cert::raw::RawCertParser`.  Notably, this includes all\nsoftware using the `sequoia_cert_store` crate.\n\n## Details\n\nThe `RawCertParser` does not advance the input stream when encountering unsupported cert (primary key) versions, resulting in an infinite loop.\n\nThe fix introduces a new raw-cert-specific `cert::raw::Error::UnuspportedCert`.\n\n## Affected software\n\n- sequoia-openpgp 1.13.0\n- sequoia-openpgp 1.14.0\n- sequoia-openpgp 1.15.0\n- sequoia-openpgp 1.16.0\n- sequoia-openpgp 1.17.0\n- sequoia-openpgp 1.18.0\n- sequoia-openpgp 1.19.0\n- sequoia-openpgp 1.20.0\n- Any software built against a vulnerable version of sequoia-openpgp which is directly or indirectly using the interface sequoia_`openpgp::cert::raw::RawCertParser`.  Notably, this includes all software using the `sequoia_cert_store` crate.","status":"published","published":"2024-06-26T19:10:15Z","modified":"2025-07-28T15:38:08Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:38:51.864708Z"}],"nvd":[{"id":"CVE-2024-58261","description":"The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of \"Reading a cert: Invalid operation: Not a Key packet\" messages for RawCertParser operations that encounter an unsupported primary key type.","status":"published","published":"2025-07-27T20:15:24.81Z","modified":"2026-06-17T08:14:43.983Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:10:47.073504Z"}],"osv":[{"id":"CVE-2024-58261","description":"The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of \"Reading a cert: Invalid operation: Not a Key packet\" messages for RawCertParser operations that encounter an unsupported primary key type.","status":"published","published":"2025-07-27T00:00:00Z","modified":"2026-10-28T02:31:00.267432147Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:44:45.107804Z"},{"id":"DEBIAN-CVE-2024-58261","description":"The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of \"Reading a cert: Invalid operation: Not a Key packet\" messages for RawCertParser operations that encounter an unsupported primary key type.","status":"published","published":"2025-07-27T20:15:24.81Z","modified":"2026-11-02T12:03:13.556084521Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:44.747956Z"},{"id":"GHSA-9344-p847-qm5c","title":"Low severity (DoS) vulnerability in sequoia-openpgp","description":"There is a denial-of-service vulnerability in sequoia-openpgp, our crate providing a low-level interface to our OpenPGP implementation. When triggered, the process will enter an infinite loop.\n\nMany thanks to Andrew Gallagher for disclosing the issue to us.\n\n## Impact\n\nAny software directly or indirectly using the interface `sequoia_openpgp::cert::raw::RawCertParser`.  Notably, this includes all\nsoftware using the `sequoia_cert_store` crate.\n\n## Details\n\nThe `RawCertParser` does not advance the input stream when encountering unsupported cert (primary key) versions, resulting in an infinite loop.\n\nThe fix introduces a new raw-cert-specific `cert::raw::Error::UnuspportedCert`.\n\n## Affected software\n\n- sequoia-openpgp 1.13.0\n- sequoia-openpgp 1.14.0\n- sequoia-openpgp 1.15.0\n- sequoia-openpgp 1.16.0\n- sequoia-openpgp 1.17.0\n- sequoia-openpgp 1.18.0\n- sequoia-openpgp 1.19.0\n- sequoia-openpgp 1.20.0\n- Any software built against a vulnerable version of sequoia-openpgp which is directly or indirectly using the interface sequoia_`openpgp::cert::raw::RawCertParser`.  Notably, this includes all software using the `sequoia_cert_store` crate.","status":"published","published":"2024-06-26T19:10:15Z","modified":"2025-10-28T06:29:08.241169Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:46:43.123867Z"},{"id":"UBUNTU-CVE-2024-58261","description":"The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of \"Reading a cert: Invalid operation: Not a Key packet\" messages for RawCertParser operations that encounter an unsupported primary key type.","status":"published","published":"2025-07-27T20:15:00Z","modified":"2025-09-08T17:06:47Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:18.664792Z"},{"id":"RUSTSEC-2024-0345","title":"Low severity (DoS) vulnerability in sequoia-openpgp","description":"There is a denial-of-service vulnerability in sequoia-openpgp, our\ncrate providing a low-level interface to our OpenPGP implementation.\nWhen triggered, the process will enter an infinite loop.\n\nMany thanks to Andrew Gallagher for disclosing the issue to us.\n\n## Impact\n\nAny software directly or indirectly using the interface\n`sequoia_openpgp::cert::raw::RawCertParser`.  Notably, this includes all\nsoftware using the `sequoia_cert_store` crate.\n\n## Details\n\nThe `RawCertParser` does not advance the input stream when\nencountering unsupported cert (primary key) versions, resulting in an\ninfinite loop.\n\nThe fix introduces a new raw-cert-specific\n`cert::raw::Error::UnuspportedCert`.\n\n## Affected software\n\n- sequoia-openpgp 1.13.0\n- sequoia-openpgp 1.14.0\n- sequoia-openpgp 1.15.0\n- sequoia-openpgp 1.16.0\n- sequoia-openpgp 1.17.0\n- sequoia-openpgp 1.18.0\n- sequoia-openpgp 1.19.0\n- sequoia-openpgp 1.20.0\n- Any software built against a vulnerable version of sequoia-openpgp\n  which is directly or indirectly using the interface\n  `sequoia_openpgp::cert::raw::RawCertParser`.  Notably, this includes\n  all software using the `sequoia_cert_store` crate.","status":"published","published":"2024-06-26T12:00:00Z","modified":"2025-10-28T06:29:08.241169Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}