{"id":"CVE-2026-41990","aliases":["BELL-CVE-2026-41990","DEBIAN-CVE-2026-41990","EUVD-2026-25193","GHSA-78pv-qq8x-94px","JLSEC-2026-497","RHSA-2026:8466","SUSE-SU-2026:22270-1","SUSE-SU-2026:22355-1","UBUNTU-CVE-2026-41990","USN-8319-1","openSUSE-SU-2026:21047-1"],"status":"published","title":"Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds...","description":"Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.","severity":{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00229,"percentile":0.13748,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2026-04-23T04:39:04Z","modified":"2026-10-28T02:30:30Z","fixes":[{"ecosystem":"Alpaquita:stream","package":"libgcrypt","fixed_in":["1.12.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libgcrypt20","fixed_in":["1.12.2-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"Libgcrypt_jll","fixed_in":["1.12.2+0"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"libgcrypt","fixed_in":["1.12.1-160000.2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libgcrypt","fixed_in":["1.12.1-160000.2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libgcrypt","fixed_in":["1.12.1-160000.2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"libgcrypt20","fixed_in":["1.12.0-2ubuntu0.1~Fips1~rc11"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libgcrypt20","fixed_in":["1.12.0-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"libgcrypt","fixed_in":["1.12.1-160000.2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:stream","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0-r0"},{"fixed":"1.12.2-r0"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-1"}]}],"versions":["1.11.0+git20250114-1","1.11.0-7","1.11.1-1","1.11.2-1","1.11.2-2","1.11.2-3","1.12.0-1","1.12.0-2","1.12.1-1","1.12.1-2"]},{"source":"osv","ecosystem":"Julia","package":"Libgcrypt_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"1.12.0+0"},{"fixed":"1.12.2+0"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.2-1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libgcrypt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.2-1.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.1-160000.2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.1-160000.2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.1-160000.2.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-2ubuntu0.1~Fips1~rc11"}]}],"versions":["1.10.3-2ubuntu0.1~Fips1~rc6","1.10.3-2ubuntu0.1~Fips1~rc7"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-2ubuntu0.1"}]}],"versions":["1.11.0-7build1","1.11.2-2","1.11.2-3","1.12.0-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-3ubuntu3.2"}]}],"versions":["1.8.7-5ubuntu2","1.9.4-3ubuntu2","1.9.4-3ubuntu3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-2ubuntu0.1"}]}],"versions":["1.10.2-3ubuntu1","1.10.3-2","1.10.3-2build1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-7ubuntu0.1"}]}],"versions":["1.11.0-6ubuntu1","1.11.0-7","1.11.0-7build1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libgcrypt20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-2ubuntu0.1"}]}],"versions":["1.11.0-7build1","1.11.2-2","1.11.2-3","1.12.0-2"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libgcrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.1-160000.2.1"}]}]}],"products":[{"vendor":"gnupg","product":"libgcrypt"}],"references":[{"url":"https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html","tags":["Mailing List","Release Notes","web","article"]},{"url":"https://www.openwall.com/lists/oss-security/2026/04/21/1","tags":["Mailing List","Release Notes","web","article","report"]},{"url":"https://dev.gnupg.org/T8208","tags":["Broken Link","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41990","tags":["advisory","web"]},{"url":"https://github.com/advisories/GHSA-78pv-qq8x-94px","tags":["web"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-41990","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41990.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-41990","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8466","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41989","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41990","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8466.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461063","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41989","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41989","tags":["advisory"]},{"url":"https://dev.gnupg.org/T8211","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461068","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41990","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622270-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262693","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41990","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622355-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-41990","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8319-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-41989","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-41990","description":"Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.","status":"published","published":"2026-04-23T04:39:04.524Z","modified":"2026-04-23T16:22:42.096Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T13:41:08.498858Z"}],"euvd":[{"id":"EUVD-2026-25193","description":"Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.","status":"published","published":"2026-04-23T04:39:04Z","modified":"2026-04-23T16:22:42Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T19:24:19.171803Z"}],"ghsa":[{"id":"GHSA-78pv-qq8x-94px","title":"Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds...","description":"Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.","status":"published","published":"2026-04-23T06:30:22Z","modified":"2026-04-23T06:30:28Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:07:35.737909Z"}],"nvd":[{"id":"CVE-2026-41990","description":"Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.","status":"published","published":"2026-04-23T05:16:05.897Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:12:15.867234Z"}],"osv":[{"id":"BELL-CVE-2026-41990","status":"published","published":"2026-04-25T06:10:19.12506Z","modified":"2026-09-04T06:00:45.441144Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:23.844435Z"},{"id":"CVE-2026-41990","description":"Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.","status":"published","published":"2026-04-23T04:39:04.524Z","modified":"2026-10-28T02:30:30.619929174Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:45:03.764807Z"},{"id":"DEBIAN-CVE-2026-41990","description":"Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.","status":"published","published":"2026-04-23T05:16:05.897Z","modified":"2026-10-27T09:47:30.330715302Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"JLSEC-2026-497","title":"Libgcrypt before 1.12.2 mishandles Dilithium signing","description":"Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.","status":"published","published":"2026-05-14T02:21:35.919Z","modified":"2026-07-25T18:24:31.580779164Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"RHSA-2026:8466","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-26T10:05:55Z","modified":"2026-10-15T10:29:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"UBUNTU-CVE-2026-41990","description":"Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.","status":"published","published":"2026-04-23T05:16:00Z","modified":"2026-08-31T17:16:21.008554895Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:56:18.393417Z"},{"id":"openSUSE-SU-2026:21047-1","title":"Security update for libgcrypt","description":"This update for libgcrypt fixes the following issue\n\n- CVE-2026-41990: lack of bound check can lead to mishandling of Dilithium signing (bsc#1262693).\n","status":"published","published":"2026-06-24T21:36:29Z","modified":"2026-06-30T18:24:29.268200258Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22270-1","title":"Security update for libgcrypt","description":"This update for libgcrypt fixes the following issue\n\n- CVE-2026-41990: lack of bound check can lead to mishandling of Dilithium signing (bsc#1262693).\n","status":"published","published":"2026-06-24T21:37:23Z","modified":"2026-06-30T18:24:33.007592226Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22355-1","title":"Security update for libgcrypt","description":"This update for libgcrypt fixes the following issue\n\n- CVE-2026-41990: lack of bound check can lead to mishandling of Dilithium signing (bsc#1262693).\n","status":"published","published":"2026-06-24T21:37:23Z","modified":"2026-07-02T18:24:13.631647428Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"USN-8319-1","title":"libgcrypt20 vulnerabilities","description":"It was discovered that Libgcrypt incorrectly handled crafted ECDH\nciphertext. An attacker could possibly use this issue to cause Libgcrypt to\ncrash, resulting in a denial of service. (CVE-2026-41989)\n\nIt was discovered that Libgcrypt incorrectly handled Dilithium signing. An\nattacker could possibly use this issue to cause Libgcrypt to crash,\nresulting in a denial of service. This issue only affected Ubuntu 26.04\nLTS. (CVE-2026-41990)","status":"published","published":"2026-05-27T12:32:26Z","modified":"2026-05-27T15:47:45.571912893Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}