{"id":"CVE-2026-41989","aliases":["ALSA-2026:47117","ALSA-2026:50144","ALSA-2026:50147","AZL-83544","BELL-CVE-2026-41989","CLSA-2026-1784632339","CLSA-2026-1784633299","DEBIAN-CVE-2026-41989","EUVD-2026-25192","GHSA-wrv8-79m2-qg24","JLSEC-2026-496","MGASA-2026-0212","OESA-2026-2345","OESA-2026-2346","OESA-2026-2347","OESA-2026-2348","RHSA-2026:47117","RHSA-2026:50144","RHSA-2026:50147","RHSA-2026:52950","RHSA-2026:52951","RHSA-2026:52952","RHSA-2026:52953","RHSA-2026:58977","RHSA-2026:58978","RHSA-2026:58979","RHSA-2026:8466","RLSA-2026:47117","RLSA-2026:50144","RLSA-2026:50147","ROOT-OS-DEBIAN-12-CVE-2026-41989","ROOT-OS-DEBIAN-13-CVE-2026-41989","SUSE-SU-2026:22760-1","SUSE-SU-2026:22826-1","SUSE-SU-2026:22907-1","SUSE-SU-2026:22919-1","SUSE-SU-2026:3182-1","SUSE-SU-2026:3491-1","SUSE-SU-2026:3921-1","UBUNTU-CVE-2026-41989","USN-8319-1","openSUSE-SU-2026:21387-1"],"status":"published","title":"Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via...","description":"Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.","severity":{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00182,"percentile":0.07913,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2026-04-23T04:30:26Z","modified":"2026-11-10T12:45:54Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"libgcrypt","fixed_in":["1.8.5-8.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libgcrypt-devel","fixed_in":["1.8.5-8.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"libgcrypt","fixed_in":["1.11.0-7.el10_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"libgcrypt-devel","fixed_in":["1.11.0-7.el10_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"libgcrypt","fixed_in":["1.10.0-13.el9_8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"libgcrypt-devel","fixed_in":["1.10.0-13.el9_8"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"libgcrypt","fixed_in":["1.10.3-2"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"libgcrypt","fixed_in":["1.10.4-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"libgcrypt","fixed_in":["1.10.4-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libgcrypt","fixed_in":["1.12.2-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"libgcrypt","fixed_in":["1.10.4-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libgcrypt","fixed_in":["1.10.0-12.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libgcrypt-devel","fixed_in":["1.10.0-12.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libgcrypt","fixed_in":["1.10.0-11.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libgcrypt-devel","fixed_in":["1.10.0-11.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libgcrypt20","fixed_in":["1.10.1-3+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libgcrypt20","fixed_in":["1.11.0-7+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libgcrypt20","fixed_in":["1.12.2-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"Libgcrypt_jll","fixed_in":["1.12.2+0"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"libgcrypt","fixed_in":["1.10.2-2.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"libgcrypt","fixed_in":["1.10.2-4.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"libgcrypt","fixed_in":["1.10.2-3.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"libgcrypt","fixed_in":["1.10.2-3.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"libgcrypt","fixed_in":["1.10.2-4.oe2403sp1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libgcrypt","fixed_in":["0:1.8.5-8.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libgcrypt-debuginfo","fixed_in":["0:1.8.5-8.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libgcrypt-debugsource","fixed_in":["0:1.8.5-8.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libgcrypt-devel","fixed_in":["0:1.8.5-8.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libgcrypt-devel-debuginfo","fixed_in":["0:1.8.5-8.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"libgcrypt-debuginfo","fixed_in":["0:1.11.0-7.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"libgcrypt-debugsource","fixed_in":["0:1.11.0-7.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"libgcrypt-devel","fixed_in":["0:1.11.0-7.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"libgcrypt-devel-debuginfo","fixed_in":["0:1.11.0-7.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"libgcrypt","fixed_in":["0:1.11.0-7.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libgcrypt-debuginfo","fixed_in":["0:1.10.0-13.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libgcrypt-debugsource","fixed_in":["0:1.10.0-13.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libgcrypt-devel","fixed_in":["0:1.10.0-13.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libgcrypt-devel-debuginfo","fixed_in":["0:1.10.0-13.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libgcrypt","fixed_in":["0:1.10.0-13.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libgcrypt-debuginfo","fixed_in":["0:1.10.0-13.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libgcrypt-debugsource","fixed_in":["0:1.10.0-13.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libgcrypt-devel-debuginfo","fixed_in":["0:1.10.0-13.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"libgcrypt","fixed_in":["0:1.10.0-11.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libgcrypt","fixed_in":["0:1.11.0-5.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"libgcrypt","fixed_in":["0:1.10.0-10.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"libgcrypt","fixed_in":["0:1.10.0-10.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"libgcrypt","fixed_in":["0:1.8.5-7.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"libgcrypt","fixed_in":["0:1.8.5-7.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"libgcrypt","fixed_in":["0:1.8.5-7.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"libgcrypt","fixed_in":["0:1.8.5-7.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"libgcrypt","fixed_in":["0:1.8.5-4.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"libgcrypt","fixed_in":["0:1.8.5-4.el8_4.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"libgcrypt","fixed_in":["0:1.8.5-8.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"libgcrypt","fixed_in":["0:1.11.0-7.el10_2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"libgcrypt","fixed_in":["0:1.10.0-13.el9_8"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-libgcrypt20","fixed_in":["1.10.1-3.root.io.4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"libgcrypt","fixed_in":["1.12.1-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libgcrypt","fixed_in":["1.12.1-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libgcrypt","fixed_in":["1.12.1-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"libgcrypt","fixed_in":["1.10.3-slfo.1.1_4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"libgcrypt","fixed_in":["1.10.3-4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libgcrypt","fixed_in":["1.11.0-150700.5.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libgcrypt","fixed_in":["1.9.4-150500.12.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libgcrypt","fixed_in":["1.9.4-150400.6.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libgcrypt","fixed_in":["1.9.4-150400.6.14.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libgcrypt20","fixed_in":["1.9.4-3ubuntu3.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"libgcrypt20","fixed_in":["1.9.4-3ubuntu3.2+Fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libgcrypt20","fixed_in":["1.10.3-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"libgcrypt20","fixed_in":["1.12.0-2ubuntu0.1~Fips1~rc11"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"libgcrypt20","fixed_in":["1.11.0-7ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libgcrypt20","fixed_in":["1.12.0-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"libgcrypt","fixed_in":["1.12.1-160000.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-8.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libgcrypt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-8.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-7.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libgcrypt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-7.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-13.el9_8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libgcrypt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-13.el9_8"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-2"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.1-r0"},{"fixed":"1.10.4-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.3-r1"},{"fixed":"1.10.4-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.1-r0"},{"fixed":"1.12.2-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.1-r0"},{"fixed":"1.10.4-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-12.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libgcrypt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-12.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-11.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libgcrypt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-11.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-3+deb12u1"}]}],"versions":["1.10.1-3"]},{"source":"osv","ecosystem":"Debian:13","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-7+deb13u1"}]}],"versions":["1.11.0-7"]},{"source":"osv","ecosystem":"Debian:14","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-1"}]}],"versions":["1.11.0+git20250114-1","1.11.0-7","1.11.1-1","1.11.2-1","1.11.2-2","1.11.2-3","1.12.0-1","1.12.0-2","1.12.1-1","1.12.1-2"]},{"source":"osv","ecosystem":"Julia","package":"Libgcrypt_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"1.8.11+0"},{"fixed":"1.12.2+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2-2.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2-4.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2-3.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2-3.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2-4.oe2403sp1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-8.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libgcrypt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-8.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libgcrypt-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-8.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libgcrypt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-8.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libgcrypt-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-8.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libgcrypt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.0-7.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libgcrypt-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.0-7.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libgcrypt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.0-7.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libgcrypt-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.0-7.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.0-7.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libgcrypt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-13.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libgcrypt-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-13.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libgcrypt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-13.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libgcrypt-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-13.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-13.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libgcrypt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-13.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libgcrypt-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-13.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libgcrypt-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-13.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-11.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.0-5.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-10.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-10.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-4.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-4.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.2-1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libgcrypt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.2-1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-8.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.0-7.el10_2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-13.el9_8"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-3.root.io.4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.1-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.1-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.1-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-slfo.1.1_4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150700.5.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-150500.12.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-150400.6.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-150400.6.14.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.3-2ubuntu1","1.6.4-3","1.6.4-4","1.6.4-5","1.6.5-2","1.6.5-2ubuntu0.2","1.6.5-2ubuntu0.3","1.6.5-2ubuntu0.4","1.6.5-2ubuntu0.5","1.6.5-2ubuntu0.6","1.6.5-2ubuntu0.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.8-2ubuntu1","1.7.9-1","1.8.1-4","1.8.1-4ubuntu1","1.8.1-4ubuntu1.1","1.8.1-4ubuntu1.2","1.8.1-4ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:18.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.1-4ubuntu1.fips.2.4","1.8.1-4ubuntu1.fips.2.5","1.8.1-4ubuntu1.fips.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:18.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.1-4ubuntu1.fips.2.4","1.8.1-4ubuntu1.fips.2.5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.4-5ubuntu2","1.8.5-3ubuntu1","1.8.5-5ubuntu1","1.8.5-5ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.5-5ubuntu1.fips.1.1","1.8.5-5ubuntu1.fips.1.4","1.8.5-5ubuntu1.fips.1.5","1.8.5-5ubuntu1.fips.1.7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:20.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.5-5ubuntu1.fips.1.1","1.8.5-5ubuntu1.fips.1.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-3ubuntu3.2"}]}],"versions":["1.8.7-5ubuntu2","1.9.4-3ubuntu2","1.9.4-3ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.4-3ubuntu3+Fips1.1","1.9.4-3ubuntu3+Fips1.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-3ubuntu3.2+Fips1"}]}],"versions":["1.9.4-3ubuntu3+Fips1.1","1.9.4-3ubuntu3+Fips1.2","1.9.4-3ubuntu3+Fips1.3","1.9.4-3ubuntu3+Fips1.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-2ubuntu0.1"}]}],"versions":["1.10.2-3ubuntu1","1.10.3-2","1.10.3-2build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-2ubuntu0.1~Fips1~rc11"}]}],"versions":["1.10.3-2ubuntu0.1~Fips1~rc6","1.10.3-2ubuntu0.1~Fips1~rc7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-7ubuntu0.1"}]}],"versions":["1.11.0-6ubuntu1","1.11.0-7","1.11.0-7build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-2ubuntu0.1"}]}],"versions":["1.11.0-7build1","1.11.2-2","1.11.2-3","1.12.0-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-3ubuntu3.2"}]}],"versions":["1.8.7-5ubuntu2","1.9.4-3ubuntu2","1.9.4-3ubuntu3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-2ubuntu0.1"}]}],"versions":["1.10.2-3ubuntu1","1.10.3-2","1.10.3-2build1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-7ubuntu0.1"}]}],"versions":["1.11.0-6ubuntu1","1.11.0-7","1.11.0-7build1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-2ubuntu0.1"}]}],"versions":["1.11.0-7build1","1.11.2-2","1.11.2-3","1.12.0-2"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.1-160000.3.1"}]}]}],"products":[{"vendor":"gnupg","product":"libgcrypt"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0)"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0)"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp (6es7518-4fx00-1ab0)"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp (6es7518-4fx00-1ac0)"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp (6ag1518-4ax00-4ac0)"}],"references":[{"url":"https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html","tags":["Third Party Advisory","web","article"]},{"url":"https://dev.gnupg.org/T8211","tags":["Broken Link","web","article"]},{"url":"https://www.openwall.com/lists/oss-security/2026/04/21/1","tags":["Third Party Advisory","web","article","report"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41989","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-wrv8-79m2-qg24","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:47117","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41989","tags":["report"]},{"url":"https://bugzilla.redhat.com/2461063","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-47117.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50144","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-50144.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50147","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-50147.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-41989","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1784632339.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1784633299.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41989.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-41989","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0212.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35427","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00205.html","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8319-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2345","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2346","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2347","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2348","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461063","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47117.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41989","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50144.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50147.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:52950","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_52950.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:52951","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_52951.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:52952","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_52952.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:52953","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_52953.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:58977","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58977.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:58978","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58978.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:58979","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58979.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8466","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41990","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8466.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461068","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41990","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41990","tags":["advisory"]},{"url":"https://dev.gnupg.org/T8208","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2026:47117","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:50144","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:50147","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622760-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262684","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41989","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622826-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622907-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622919-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263182-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263491-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263921-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-41989","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-41990","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-41989","description":"Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.","status":"published","published":"2026-04-23T04:30:26.124Z","modified":"2026-11-10T12:45:54.34Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-10T13:38:45.30478Z"}],"euvd":[{"id":"EUVD-2026-25192","description":"Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.","status":"published","published":"2026-04-23T04:30:26Z","modified":"2026-11-10T12:45:54Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-10T14:21:10.443548Z"}],"ghsa":[{"id":"GHSA-wrv8-79m2-qg24","title":"Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via...","description":"Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.","status":"published","published":"2026-04-23T06:30:22Z","modified":"2026-10-15T03:35:40Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:13:32.679528Z"}],"nvd":[{"id":"CVE-2026-41989","description":"Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.","status":"published","published":"2026-04-23T05:16:05.75Z","modified":"2026-11-10T13:19:06.897Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-10T16:19:46.342471Z"}],"osv":[{"id":"BELL-CVE-2026-41989","status":"published","published":"2026-04-25T06:10:19.65496Z","modified":"2026-09-04T07:15:15.524724528Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:23.844435Z"},{"id":"CVE-2026-41989","description":"Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.","status":"published","published":"2026-04-23T04:30:26.124Z","modified":"2026-11-11T02:30:56.845486591Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-11T11:06:45.459796Z"},{"id":"DEBIAN-CVE-2026-41989","description":"Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.","status":"published","published":"2026-04-23T05:16:05.75Z","modified":"2026-11-11T09:47:35.685036565Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-11T10:35:40.696585Z"},{"id":"JLSEC-2026-496","title":"Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via...","description":"Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to `gcry_pk_decrypt`.","status":"published","published":"2026-05-14T02:21:35.919Z","modified":"2026-07-25T18:24:31.554858173Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2026-2345","title":"libgcrypt security update","description":"Libgcrypt is a general purpose cryptographic library originally based on code from GnuPG.\r\n\r\nSecurity Fix(es):\n\nLibgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.(CVE-2026-41989)","status":"published","published":"2026-05-15T11:11:18Z","modified":"2026-08-18T01:19:57.495607094Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2346","title":"libgcrypt security update","description":"Libgcrypt is a general purpose cryptographic library originally based on code from GnuPG.\r\n\r\nSecurity Fix(es):\n\nLibgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.(CVE-2026-41989)","status":"published","published":"2026-05-15T11:11:18Z","modified":"2026-08-18T01:19:55.147395223Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2347","title":"libgcrypt security update","description":"Libgcrypt is a general purpose cryptographic library originally based on code from GnuPG.\r\n\r\nSecurity Fix(es):\n\nLibgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.(CVE-2026-41989)","status":"published","published":"2026-05-15T11:11:18Z","modified":"2026-08-18T01:19:57.845729691Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2348","title":"libgcrypt security update","description":"Libgcrypt is a general purpose cryptographic library originally based on code from GnuPG.\r\n\r\nSecurity Fix(es):\n\nLibgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.(CVE-2026-41989)","status":"published","published":"2026-05-15T11:11:18Z","modified":"2026-08-18T01:19:54.740244005Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"RHSA-2026:47117","title":"Red Hat Security Advisory: libgcrypt security update","status":"published","published":"2026-08-13T10:16:05Z","modified":"2026-10-15T10:19:54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:50144","title":"Red Hat Security Advisory: libgcrypt security update","status":"published","published":"2026-08-05T10:37:31Z","modified":"2026-10-15T10:20:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:50147","title":"Red Hat Security Advisory: libgcrypt security update","status":"published","published":"2026-08-05T10:37:31Z","modified":"2026-10-15T10:20:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:52950","title":"Red Hat Security Advisory: libgcrypt security update","status":"published","published":"2026-08-11T10:12:07Z","modified":"2026-10-15T10:21:03Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:52951","title":"Red Hat Security Advisory: libgcrypt security update","status":"published","published":"2026-08-11T10:12:08Z","modified":"2026-10-15T10:21:03Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:52952","title":"Red Hat Security Advisory: libgcrypt security update","status":"published","published":"2026-08-11T10:12:08Z","modified":"2026-10-15T10:21:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:52953","title":"Red Hat Security Advisory: libgcrypt security update","status":"published","published":"2026-08-11T10:12:08Z","modified":"2026-10-15T10:21:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:58977","title":"Red Hat Security Advisory: libgcrypt security update","status":"published","published":"2026-08-25T10:23:06Z","modified":"2026-10-15T10:22:15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:58978","title":"Red Hat Security Advisory: libgcrypt security update","status":"published","published":"2026-08-25T10:23:07Z","modified":"2026-10-15T10:22:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:58979","title":"Red Hat Security Advisory: libgcrypt security update","status":"published","published":"2026-08-25T10:23:07Z","modified":"2026-10-15T10:22:17Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:8466","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-26T10:05:55Z","modified":"2026-10-15T10:29:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:47117","title":"Moderate: libgcrypt security update","description":"The libgcrypt library provides general-purpose implementations of various cryptographic algorithms.\n\nSecurity Fix(es):\n\n* Libgcrypt: Libgcrypt: Denial of Service and buffer overflow via crafted ECDH ciphertext (CVE-2026-41989)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-12T18:00:56.554626Z","modified":"2026-08-12T18:25:47.688229158Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:50144","title":"Moderate: libgcrypt security update","description":"The libgcrypt library provides general-purpose implementations of various cryptographic algorithms.\n\nSecurity Fix(es):\n\n* Libgcrypt: Libgcrypt: Denial of Service and buffer overflow via crafted ECDH ciphertext (CVE-2026-41989)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-06T00:07:16.929494Z","modified":"2026-08-06T00:30:06.462824539Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:50147","title":"Moderate: libgcrypt security update","description":"The libgcrypt library provides general-purpose implementations of various cryptographic algorithms.\n\nSecurity Fix(es):\n\n* Libgcrypt: Libgcrypt: Denial of Service and buffer overflow via crafted ECDH ciphertext (CVE-2026-41989)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-06T00:04:20.676095Z","modified":"2026-08-06T00:30:07.880335442Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-41989","title":"CVE-2026-41989 in rootio-libgcrypt20 - Patched by Root","description":"Root has patched CVE-2026-41989 in the rootio-libgcrypt20 package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-05-04T12:21:56Z","modified":"2026-07-28T12:34:58Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:32.037361Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-41989","title":"CVE-2026-41989 in rootio-libgcrypt20 - Patched by Root","description":"Root has patched CVE-2026-41989 in the rootio-libgcrypt20 package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-04-29T12:28:52Z","modified":"2026-08-27T14:00:04.407024621Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"UBUNTU-CVE-2026-41989","description":"Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.","status":"published","published":"2026-04-23T05:16:00Z","modified":"2026-08-31T17:16:14.824575994Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:18.393417Z"},{"id":"ALSA-2026:47117","title":"Moderate: libgcrypt security update","description":"The libgcrypt library provides general-purpose implementations of various cryptographic algorithms.  \n\nSecurity Fix(es):  \n\n  * Libgcrypt: Libgcrypt: Denial of Service and buffer overflow via crafted ECDH ciphertext (CVE-2026-41989)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-28T00:00:00Z","modified":"2026-10-29T11:02:24.685764977Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:50144","title":"Moderate: libgcrypt security update","description":"The libgcrypt library provides general-purpose implementations of various cryptographic algorithms.  \n\nSecurity Fix(es):  \n\n  * Libgcrypt: Libgcrypt: Denial of Service and buffer overflow via crafted ECDH ciphertext (CVE-2026-41989)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-04T00:00:00Z","modified":"2026-10-29T11:30:34.740553234Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:50147","title":"Moderate: libgcrypt security update","description":"The libgcrypt library provides general-purpose implementations of various cryptographic algorithms.  \n\nSecurity Fix(es):  \n\n  * Libgcrypt: Libgcrypt: Denial of Service and buffer overflow via crafted ECDH ciphertext (CVE-2026-41989)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-04T00:00:00Z","modified":"2026-10-29T11:32:24.081578184Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"AZL-83544","title":"CVE-2026-41989 affecting package libgcrypt for versions less than 1.10.3-2","description":"Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.","status":"published","published":"2026-04-23T05:16:05Z","modified":"2026-09-08T17:33:11Z","updated_at":"2026-11-02T15:28:10.335477Z"},{"id":"CLSA-2026-1784632339","title":"libgcrypt: Fix of CVE-2026-41989","description":"- CVE-2026-41989: heap OOB write in _gcry_ecc_mont_decodepoint","status":"published","published":"2026-07-21T11:12:50Z","modified":"2026-10-26T09:30:13.19185961Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784633299","title":"libgcrypt: Fix of CVE-2026-41989","description":"- CVE-2026-41989: fix out-of-bounds write in _gcry_ecc_mont_decodepoint for short Montgomery-curve points","status":"published","published":"2026-07-21T11:28:44Z","modified":"2026-10-26T09:31:18.397887739Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"MGASA-2026-0212","title":"Updated libgcrypt packages fix security vulnerability","description":"Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow\nand denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.\n(CVE-2026-41989)\n","status":"published","published":"2026-06-15T15:56:35Z","modified":"2026-06-15T16:00:04.065252797Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:21387-1","title":"Security update for libgcrypt","description":"This update for libgcrypt fixes the following issue\n\n- CVE-2026-41989: crafted ECDH ciphertext can lead denial of service (bsc#1262684).\n","status":"published","published":"2026-07-20T09:26:51Z","modified":"2026-07-24T18:24:21.74344315Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22760-1","title":"Security update for libgcrypt","description":"This update for libgcrypt fixes the following issue\n\n- CVE-2026-41989: crafted ECDH ciphertext can lead denial of service (bsc#1262684).\n","status":"published","published":"2026-07-20T09:26:19Z","modified":"2026-07-23T18:24:20.229451998Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22826-1","title":"Security update for libgcrypt","description":"This update for libgcrypt fixes the following issue\n\n- CVE-2026-41989: crafted ECDH ciphertext can lead denial of service (bsc#1262684).\n","status":"published","published":"2026-07-20T09:26:19Z","modified":"2026-07-28T18:24:08.023736875Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22907-1","title":"Security update for libgcrypt","description":"This update for libgcrypt fixes the following issue:\n\n- CVE-2026-41989: crafted ECDH ciphertext can lead denial of service (bsc#1262684).\n","status":"published","published":"2026-07-24T07:29:34Z","modified":"2026-07-28T18:24:19.442985062Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22919-1","title":"Security update for libgcrypt","description":"This update for libgcrypt fixes the following issue\n\n- CVE-2026-41989: heap-based buffer overflow when processing crafted ECDH ciphertext can lead to a denial of service\n  (bsc#1262684).\n","status":"published","published":"2026-07-24T08:08:28Z","modified":"2026-07-28T18:24:15.004601132Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:3182-1","title":"Security update for libgcrypt","description":"This update for libgcrypt fixes the following issue\n\n- CVE-2026-41989: heap-based buffer overflow when processing crafted ECDH ciphertext can lead to a denial of service\n  (bsc#1262684).\n","status":"published","published":"2026-07-22T07:25:47Z","modified":"2026-07-23T09:45:05.454468638Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3491-1","title":"Security update for libgcrypt","description":"This update for libgcrypt fixes the following issue\n\n- CVE-2026-41989: heap-based buffer overflow when processing crafted ECDH ciphertext can lead to a denial of service\n  (bsc#1262684).\n","status":"published","published":"2026-08-04T11:58:45Z","modified":"2026-08-04T18:30:05.193792468Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3921-1","title":"Security update for libgcrypt","description":"This update for libgcrypt fixes the following issue:\n\n- CVE-2026-41989: crafted ECDH ciphertext can lead denial of service (bsc#1262684).\n","status":"published","published":"2026-09-02T07:32:29Z","modified":"2026-09-10T18:23:21.570257062Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-8319-1","title":"libgcrypt20 vulnerabilities","description":"It was discovered that Libgcrypt incorrectly handled crafted ECDH\nciphertext. An attacker could possibly use this issue to cause Libgcrypt to\ncrash, resulting in a denial of service. (CVE-2026-41989)\n\nIt was discovered that Libgcrypt incorrectly handled Dilithium signing. An\nattacker could possibly use this issue to cause Libgcrypt to crash,\nresulting in a denial of service. This issue only affected Ubuntu 26.04\nLTS. (CVE-2026-41990)","status":"published","published":"2026-05-27T12:32:26Z","modified":"2026-05-27T15:47:45.571912893Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}