{"id":"CVE-2026-57062","aliases":["AZL-91170","BELL-CVE-2026-57062","CLSA-2026-1785557084","CLSA-2026-1786609750","DEBIAN-CVE-2026-57062","EUVD-2026-38550","GHSA-m6x2-4hhh-669j","JLSEC-2026-1084","OESA-2026-2858","OESA-2026-2859","OESA-2026-2860","RHSA-2026:82418","SUSE-SU-2026:22757-1","SUSE-SU-2026:22825-1","SUSE-SU-2026:22923-1","SUSE-SU-2026:23007-1","SUSE-SU-2026:3243-1","UBUNTU-CVE-2026-57062","USN-8720-1","openSUSE-SU-2026:11213-1","openSUSE-SU-2026:21385-1"],"status":"published","title":"CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS...","description":"CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.","severity":{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00142,"percentile":0.03627,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-1284"],"published":"2026-06-23T17:26:25Z","modified":"2026-11-05T05:40:51Z","exploits":[{"source":"pocgithub","id":"goldendivider/gpgsm-cve-2026-57062-cms-gcm-short-tag","title":"goldendivider/gpgsm-cve-2026-57062-cms-gcm-short-tag","date":"2026-09-05","url":"https://github.com/goldendivider/gpgsm-cve-2026-57062-cms-gcm-short-tag"}],"fixes":[{"ecosystem":"Azure Linux:3","package":"gnupg2","fixed_in":["2.4.9-3"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"gnupg","fixed_in":["2.2.40-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"gnupg","fixed_in":["2.4.9-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"gnupg","fixed_in":["2.4.9-r2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"gnupg2","fixed_in":["2.3.3-2.el9_0.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"gnupg2-smime","fixed_in":["2.3.3-2.el9_0.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"gnupg2","fixed_in":["2.3.3-4.el9_6.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"gnupg2-smime","fixed_in":["2.3.3-4.el9_6.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gnupg2","fixed_in":["2.4.9-5"],"sources":["osv"]},{"ecosystem":"Julia","package":"GnuPG_jll","fixed_in":["2.5.21+0"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"gnupg2","fixed_in":["2.4.3-16.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"gnupg2","fixed_in":["2.4.3-16.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"gnupg2","fixed_in":["2.2.32-10.oe2203sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gnupg2","fixed_in":["0:2.4.9-18.3.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-dirmngr","fixed_in":["0:2.4.9-18.3.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-g13","fixed_in":["0:2.4.9-18.3.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-gpg-agent","fixed_in":["0:2.4.9-18.3.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-gpgconf","fixed_in":["0:2.4.9-18.3.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-keyboxd","fixed_in":["0:2.4.9-18.3.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-scdaemon","fixed_in":["0:2.4.9-18.3.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-smime","fixed_in":["0:2.4.9-18.3.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-utils","fixed_in":["0:2.4.9-18.3.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-verify","fixed_in":["0:2.4.9-18.3.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-wks","fixed_in":["0:2.4.9-18.3.hum1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"gpg2","fixed_in":["2.5.5-160000.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"gpg2","fixed_in":["2.5.5-160000.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"gpg2","fixed_in":["2.5.5-160000.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"gpg2","fixed_in":["2.4.4-slfo.1.1_9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"gpg2","fixed_in":["2.4.4-9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"gpg2","fixed_in":["2.4.4-150600.3.18.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"gnupg2","fixed_in":["2.4.4-2ubuntu17.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"gnupg2","fixed_in":["2.4.8-4ubuntu3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"gpg2","fixed_in":["2.5.21-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"gpg2","fixed_in":["2.5.5-160000.6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.40-r0"},{"fixed":"2.2.40-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.7-r0"},{"fixed":"2.4.9-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0-r1"},{"fixed":"2.4.9-r2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-2.el9_0.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gnupg2-smime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-2.el9_0.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-4.el9_6.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gnupg2-smime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-4.el9_6.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.40-1.1","2.2.40-1.1+deb12u1","2.2.40-1.1+deb12u2","2.2.40-1.1+hurd.1","2.2.40-1.1+loong64","2.2.40-2","2.2.40-3","2.2.43-1","2.2.43-2","2.2.43-3","2.2.43-4","2.2.43-5","2.2.43-6","2.2.43-7","2.2.43-8","2.2.44-1","2.2.45-1","2.2.45-2","2.2.45-3","2.2.46-1","2.2.46-2","2.2.46-3","2.2.46-4","2.2.46-5","2.2.46-6","2.2.46~pre1-1","2.3.1-1","2.4.3-2","2.4.4-1","2.4.4-2","2.4.4-3","2.4.4-4","2.4.5-1","2.4.5-2","2.4.5-3","2.4.6-1","2.4.7-1","2.4.7-10","2.4.7-11","2.4.7-12","2.4.7-13","2.4.7-14","2.4.7-15","2.4.7-16","2.4.7-17","2.4.7-18","2.4.7-19","2.4.7-2","2.4.7-20","2.4.7-21","2.4.7-3","2.4.7-4","2.4.7-5","2.4.7-6","2.4.7-7","2.4.7-8","2.4.7-9","2.4.8-1","2.4.8-2","2.4.8-3","2.4.8-4","2.4.8-5","2.4.8-6","2.4.9-1","2.4.9-2","2.4.9-3","2.4.9-4","2.4.9-5","2.4.9-6","2.4.9-7"]},{"source":"osv","ecosystem":"Debian:13","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-21","2.4.7-21+deb13u1","2.4.8-1","2.4.8-2","2.4.8-3","2.4.8-4","2.4.8-5","2.4.8-6","2.4.9-1","2.4.9-2","2.4.9-3","2.4.9-4","2.4.9-5","2.4.9-6","2.4.9-7"]},{"source":"osv","ecosystem":"Debian:14","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-5"}]}],"versions":["2.4.7-21","2.4.8-1","2.4.8-2","2.4.8-3","2.4.8-4","2.4.8-5","2.4.8-6","2.4.9-1","2.4.9-2","2.4.9-3","2.4.9-4"]},{"source":"osv","ecosystem":"Julia","package":"GnuPG_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.5.21+0"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-16.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-16.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.32-10.oe2203sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-18.3.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-dirmngr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-18.3.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-g13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-18.3.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-gpg-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-18.3.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-gpgconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-18.3.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-keyboxd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-18.3.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-scdaemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-18.3.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-smime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-18.3.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-18.3.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-verify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-18.3.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnupg2-wks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-18.3.hum1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-160000.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-160000.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-160000.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-slfo.1.1_9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150600.3.18.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-2ubuntu17.6"}]}],"versions":["2.2.40-1.1ubuntu1","2.4.4-2ubuntu7","2.4.4-2ubuntu15","2.4.4-2ubuntu16","2.4.4-2ubuntu17","2.4.4-2ubuntu17.2","2.4.4-2ubuntu17.3","2.4.4-2ubuntu17.4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.4-2ubuntu23","2.4.4-2ubuntu24","2.4.7-17ubuntu3","2.4.8-2ubuntu1","2.4.8-2ubuntu2","2.4.8-2ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.8-4ubuntu3.1"}]}],"versions":["2.4.8-2ubuntu2","2.4.8-4ubuntu1","2.4.8-4ubuntu2","2.4.8-4ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-2ubuntu17.6"}]}],"versions":["2.2.40-1.1ubuntu1","2.4.4-2ubuntu7","2.4.4-2ubuntu15","2.4.4-2ubuntu16","2.4.4-2ubuntu17","2.4.4-2ubuntu17.2","2.4.4-2ubuntu17.3","2.4.4-2ubuntu17.4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.8-4ubuntu3.1"}]}],"versions":["2.4.8-2ubuntu2","2.4.8-4ubuntu1","2.4.8-4ubuntu2","2.4.8-4ubuntu3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.21-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-160000.6.1"}]}]}],"products":[{"vendor":"gnupg","product":"gnupg"}],"references":[{"url":"https://blog.calif.io/p/how-to-format-a-ciphertext","tags":["web","article","report"]},{"url":"https://www.gnupg.org/download/","tags":["web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57062","tags":["web","advisory"]},{"url":"https://www.gnupg.org/download","tags":["web"]},{"url":"https://github.com/advisories/GHSA-m6x2-4hhh-669j","tags":["web"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-57062","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1785557084.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1786609750.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-57062","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2858","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2859","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2860","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82418","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-57062","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_82418.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491859","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-57062","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622757-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1269279","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57062","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622825-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622923-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623007-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263243-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-57062","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8720-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-57062","description":"CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.","status":"published","published":"2026-06-23T17:26:25.133Z","modified":"2026-06-23T17:35:30.113Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-1284"],"updated_at":"2026-11-02T13:43:44.898272Z"}],"euvd":[{"id":"EUVD-2026-38550","description":"CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.","status":"published","published":"2026-06-23T17:26:25Z","modified":"2026-06-23T17:35:30Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T18:20:31.51905Z"}],"ghsa":[{"id":"GHSA-m6x2-4hhh-669j","title":"CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS...","description":"CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.","status":"published","published":"2026-06-23T18:31:45Z","modified":"2026-06-23T18:31:56Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-1284"],"updated_at":"2026-11-02T15:08:57.478089Z"}],"nvd":[{"id":"CVE-2026-57062","description":"CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.","status":"published","published":"2026-06-23T18:18:10.973Z","modified":"2026-06-25T20:16:05.473Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-1284"],"updated_at":"2026-11-02T14:12:25.288279Z"}],"osv":[{"id":"BELL-CVE-2026-57062","status":"published","published":"2026-06-25T06:12:51.212992Z","modified":"2026-07-07T07:15:30.590829379Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"DEBIAN-CVE-2026-57062","description":"CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.","status":"published","published":"2026-06-23T18:18:10.973Z","modified":"2026-10-01T03:03:27.483944665Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"JLSEC-2026-1084","title":"CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS...","description":"CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.","status":"published","published":"2026-07-31T13:46:32.466Z","modified":"2026-07-31T14:05:36.61844601Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2026-2858","title":"gnupg2 security update","description":"GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also known as PGP).  GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories.\r\n\r\nSecurity Fix(es):\n\nCMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.(CVE-2026-57062)","status":"published","published":"2026-07-06T11:11:46Z","modified":"2026-08-18T01:21:15.053582322Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2859","title":"gnupg2 security update","description":"GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also known as PGP).  GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories.\r\n\r\nSecurity Fix(es):\n\nCMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.(CVE-2026-57062)","status":"published","published":"2026-07-06T11:11:46Z","modified":"2026-08-18T01:21:14.040623048Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2860","title":"gnupg2 security update","description":"GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also known as PGP).  GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories.\r\n\r\nSecurity Fix(es):\n\nCMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.(CVE-2026-57062)","status":"published","published":"2026-07-06T11:11:46Z","modified":"2026-08-18T01:21:14.262777855Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"RHSA-2026:82418","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-10-14T10:32:51Z","modified":"2026-10-20T10:17:03Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"UBUNTU-CVE-2026-57062","description":"CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.","status":"published","published":"2026-06-23T18:18:00Z","modified":"2026-09-03T22:55:07.188100445Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"AZL-91170","title":"CVE-2026-57062 affecting package gnupg2 for versions less than 2.4.9-3","description":"CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.","status":"published","published":"2026-06-23T18:18:10Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.633663Z"},{"id":"CLSA-2026-1785557084","title":"gnupg2: Fix of CVE-2026-57062","description":"- CVE-2026-57062: require a minimum AES-GCM authentication tag length of\n  12 octets in gpgsm CMS decryption; a 4-octet aes-ICVlen was previously\n  accepted, weakening the integrity guarantee of the message","status":"published","published":"2026-08-01T04:04:59Z","modified":"2026-10-26T09:30:29.045135676Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1786609750","title":"gnupg2: Fix of CVE-2026-57062","description":"- CVE-2026-57062: require a minimum AES-GCM authentication tag length of\n  12 octets in gpgsm CMS decryption; a 4-octet aes-ICVlen was previously\n  accepted, weakening the integrity guarantee of the message","status":"published","published":"2026-08-13T08:29:20Z","modified":"2026-10-26T09:31:26.297738621Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"openSUSE-SU-2026:11213-1","title":"dirmngr-2.5.21-1.1 on GA media","description":"These are all security issues fixed in the dirmngr-2.5.21-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-08T00:00:00Z","modified":"2026-07-09T10:00:09.551383566Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21385-1","title":"Security update for gpg2","description":"This update for gpg2 fixes the following issue:\n\n- CVE-2026-57062: CMS parsing in gpgsm mishandles the CMS format for AES-GCM (bsc#1269279).\n","status":"published","published":"2026-07-20T03:14:32Z","modified":"2026-07-24T18:24:21.599777343Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22757-1","title":"Security update for gpg2","description":"This update for gpg2 fixes the following issue:\n\n- CVE-2026-57062: CMS parsing in gpgsm mishandles the CMS format for AES-GCM (bsc#1269279).\n","status":"published","published":"2026-07-20T03:15:09Z","modified":"2026-07-23T18:24:19.602294028Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22825-1","title":"Security update for gpg2","description":"This update for gpg2 fixes the following issue:\n\n- CVE-2026-57062: CMS parsing in gpgsm mishandles the CMS format for AES-GCM (bsc#1269279).\n","status":"published","published":"2026-07-20T03:15:09Z","modified":"2026-07-28T18:24:08.026208649Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22923-1","title":"Security update for gpg2","description":"This update for gpg2 fixes the following issue\n\n- CVE-2026-57062: CMS parsing in `gpgsm` mishandles the CMS format for AES-GCM (bsc#1269279).\n","status":"published","published":"2026-07-24T12:35:48Z","modified":"2026-07-28T18:24:20.060079118Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23007-1","title":"Security update for gpg2","description":"This update for gpg2 fixes the following issue:\n\n- CVE-2026-57062: CMS parsing in gpgsm mishandles the CMS format for AES-GCM (bsc#1269279).\n","status":"published","published":"2026-07-28T06:35:58Z","modified":"2026-08-12T18:23:43.994869537Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:3243-1","title":"Security update for gpg2","description":"This update for gpg2 fixes the following issue:\n\n- CVE-2026-57062: CMS parsing in gpgsm mishandles the CMS format for AES-GCM (bsc#1269279).\n","status":"published","published":"2026-07-24T13:09:35Z","modified":"2026-07-28T18:24:20.050227468Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"USN-8720-1","title":"gnupg2 vulnerability","description":"It was discovered that GnuPG incorrectly validated authentication tag\nlengths when parsing CMS messages encrypted with AES-GCM. An attacker could\npossibly use this issue to bypass message integrity checks.","status":"published","published":"2026-09-03T12:55:50Z","modified":"2026-09-03T22:56:56.075624568Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}