Gnupg vulnerabilities

Products

• Gnupg 38
• Libgcrypt 17
• Libksba 9

Newest

• gnupg CVE-2026-118131 CVE-2026-118131 9.8 CriticalOctober 27, 2026
• gnupg gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When... CVE-2026-105712 Fix available 3.6 LowOctober 5, 2026
• gnupg CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS... CVE-2026-57062 Public exploitFix available 2.9 LowJune 23, 2026
• gnupg libgcrypt Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds... CVE-2026-41990 Fix available 4.0 MediumApril 23, 2026
• gnupg libgcrypt, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 more Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via... CVE-2026-41989 Fix available 6.7 MediumApril 23, 2026
• gnupg, gpg4win +1 more In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success... CVE-2026-24883 Fix available 3.7 LowJanuary 27, 2026
• gnupg, gpg4win, red hat enterprise linux 10 +5 more +7 more In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the... CVE-2026-24882 Fix available 8.4 HighJanuary 27, 2026
• gnupg, gpg4win, red hat enterprise linux 10 +4 more +6 more In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized... CVE-2026-24881 Fix available 8.1 HighJanuary 27, 2026
• gnupg In GnuPG through 2.4.8, armor_filter in g10/armor.c has two increments of an index variable where... CVE-2025-68973 Fix available 7.8 HighDecember 28, 2025
• gnupg In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary... CVE-2025-68972 Fix available 5.9 MediumDecember 27, 2025
• gnupg In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data... CVE-2025-30258 Fix available 2.7 LowMarch 19, 2025
• gnupg GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with... CVE-2022-3219 Fix available 3.3 LowFebruary 23, 2023
• gnupg libksba, debian linux +1 more Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser. CVE-2022-47629 Fix available 9.8 CriticalDecember 20, 2022
• gnupg libksba, gnupg, gnupg vs-desktop +1 more +3 more A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser... CVE-2022-3515 Fix available 9.8 CriticalOctober 17, 2022
• gnupg, debian linux, fedoraproject fedora +2 more +4 more GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information... CVE-2022-34903 Fix available 6.5 MediumJuly 1, 2022
• gnupg libgcrypt The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during... CVE-2021-40528 Fix available 5.9 MediumJune 25, 2021
• gnupg libgcrypt, debian linux, fedoraproject fedora +8 more +10 more Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks... CVE-2021-33560 Public exploitFix available 7.5 HighJune 8, 2021
• gnupg libgcrypt, oracle communications billing and revenue management +1 more _gcry_md_block_write in cipher/hash-common.c in Libgcrypt before 1.9.1 has a heap-based buffer... CVE-2021-3345 Public exploit 7.8 HighJanuary 29, 2021
• gnupg, gpg4win +1 more GnuPG 2.2.21 and 2.2.22 (and Gpg4win 3.1.12) has an array overflow, leading to a crash or... CVE-2020-25125 Fix available 7.8 HighSeptember 3, 2020
• gnupg, canonical ubuntu linux, fedoraproject fedora +1 more +3 more A flaw was found in the way certificate signatures could be forged using collisions found in the... CVE-2019-14855 Fix available 5.3 MediumNovember 30, 2019
• dirmngr, debian linux, gnupg +1 more +3 more dirmngr before 2.1.0 improperly handles certain system calls, which allows remote attackers to... CVE-2011-2207 5.3 MediumNovember 27, 2019
• gnupg, sks keyserver project keyserver, f5 traffix signaling delivery controller +2 more +4 more Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG... CVE-2019-13050 Fix available 7.5 HighJune 29, 2019
• gnupg libgcrypt, opensuse leap, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp +2 more +4 more In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel... CVE-2019-12904 Fix availableDisputed 5.9 MediumJune 19, 2019
• gnupg, canonical ubuntu linux +1 more GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in... CVE-2018-1000858 Fix available 8.8 HighDecember 20, 2018
• gnupg libgcrypt, canonical ubuntu linux, debian linux +8 more +10 more Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA... CVE-2018-0495 Fix available 4.7 MediumJune 13, 2018
• gnupg, canonical ubuntu linux, debian linux +6 more +8 more mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and... CVE-2018-12020 Fix available 7.5 HighJune 8, 2018
• gnupg, canonical ubuntu linux +1 more GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an... CVE-2018-9234 Fix available 7.5 HighApril 3, 2018
• gnupg libgcrypt cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly... CVE-2018-6829 Fix available 7.5 HighFebruary 7, 2018
• gnupg libgcrypt, debian linux +1 more Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it... CVE-2017-0379 Fix available 7.5 HighAugust 29, 2017
• gnupg libgcrypt, canonical ubuntu linux, debian linux +2 more libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a... CVE-2017-7526 Fix available 6.1 MediumJune 29, 2017
• gnupg libgcrypt In Libgcrypt before 1.7.7, an attacker who learns the EdDSA session key (from side-channel... CVE-2017-9526 Fix available 5.9 MediumJune 10, 2017
• gnupg, gnupg libgcrypt, canonical ubuntu linux +1 more +3 more The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6... CVE-2016-6313 Fix available 5.3 MediumAugust 17, 2016
• gnupg libksba, canonical ubuntu linux, opensuse leap +2 more Libksba before 1.3.4 allows remote attackers to cause a denial of service (out-of-bounds read and... CVE-2016-4579 Fix available 7.5 HighMay 13, 2016
• gnupg libksba, canonical ubuntu linux, opensuse leap +1 more +3 more Off-by-one error in the append_utf8_value function in the DN decoder (dn.c) in Libksba before 1.3... CVE-2016-4574 Fix available 7.5 HighMay 13, 2016
• gnupg libksba, canonical ubuntu linux +1 more The append_utf8_value function in the DN decoder (dn.c) in Libksba before 1.3.3 allows remote... CVE-2016-4356 Fix available 7.5 HighApril 29, 2016
• gnupg libksba, canonical ubuntu linux +1 more Multiple integer overflows in ber-decoder.c in Libksba before 1.3.3 allow remote attackers to... CVE-2016-4355 Fix available 7.5 HighApril 29, 2016
• gnupg libksba, canonical ubuntu linux +1 more ber-decoder.c in Libksba before 1.3.3 uses an incorrect integer data type, which allows remote... CVE-2016-4354 Fix available 7.5 HighApril 29, 2016
• gnupg libksba, canonical ubuntu linux +1 more ber-decoder.c in Libksba before 1.3.3 does not properly handle decoder stack overflows, which... CVE-2016-4353 Fix available 7.5 HighApril 29, 2016
• gnupg libgcrypt, canonical ubuntu linux, debian linux +2 more Libgcrypt before 1.6.5 does not properly perform elliptic-point curve multiplication during... CVE-2015-7511 Fix available 2.0 LowDecember 31, 2015
• gnu gnupg, libgcrypt, debian linux +2 more The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to... CVE-2015-0837 Fix available 5.9 MediumMarch 2, 2015
• gnupg, canonical ubuntu linux +1 more kbx/keybox-search.c in GnuPG before 1.4.19, 2.0.x before 2.0.27, and 2.1.x before 2.1.2 does not... CVE-2015-1607 Fix available 5.5 MediumFebruary 16, 2015
• gnupg, debian linux +1 more The keyring DB in GnuPG before 2.1.2 does not properly handle invalid packets, which allows... CVE-2015-1606 Fix available 5.5 MediumFebruary 16, 2015
• gnu gnupg, libgcrypt, debian linux +2 more Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal... CVE-2014-3591 Fix available 4.2 MediumDecember 31, 2014
• gnupg, gnupg libksba, canonical ubuntu linux +2 more +4 more Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG,... CVE-2014-9087 Fix available 7.5 HighNovember 26, 2014
• gnupg libgcrypt, debian linux +1 more Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext... CVE-2014-5270 Fix available 2.1 LowAugust 18, 2014
• gnupg, debian linux, opensuse +2 more The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24... CVE-2014-4617 Fix available 5.0 MediumJune 25, 2014
• gnupg GnuPG 1.x before 1.4.16 generates RSA keys using sequences of introductions with certain patterns... CVE-2013-4576 Fix available 2.1 LowDecember 18, 2013
• gnupg, canonical ubuntu linux +1 more The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote... CVE-2013-4402 Fix available 5.0 MediumOctober 9, 2013
• gnupg GnuPG 1.4.x, 2.0.x, and 2.1.x treats a key flags subpacket with all bits cleared (no usage... CVE-2013-4351 Fix available 5.8 MediumOctober 9, 2013
• gnupg, gnupg libgcrypt, canonical ubuntu linux +2 more +4 more GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and possibly other... CVE-2013-4242 Fix available 1.9 LowJuly 29, 2013
• Show olderLoading…