In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS."
CVSS Details
- CVSS 3.1 Base Score: 2.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade gnupg2-minimalUpgrade gnupg2Upgrade gnupg2-smime-debuginfoUpgrade gnupg2-minimal-debuginfoUpgrade gnupg2-debugsourceUpgrade gnupg2-debuginfoUpgrade gnupg2-smime | Jul 30, 2025 | Mar 19, 2025 |
| Debian | — | Upgrade gnupg2No solution exists | May 15, 2025 | Mar 19, 2025 |
| Dell Powerstore Dsa2026115 | — | Upgrade Dell PowerStoreOS to the latest version | Feb 25, 2026 | Feb 24, 2026 |
| Huawei Euleros 2_0_sp10 | — | Upgrade gnupg2 | Sep 15, 2025 | Aug 9, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade gnupg2 | Aug 13, 2025 | Aug 9, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade gnupg2 | Sep 15, 2025 | Aug 9, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade gnupg2 | Aug 13, 2025 | Aug 9, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 19, 2025 |
| Suse | — | Upgrade dirmngrUpgrade gpg2Upgrade gpg2-langUpgrade gpg2-tpm | Dec 5, 2025 | Jul 1, 2025 |
| Ubuntu | — | Upgrade gpgUpgrade gpgv2 (Ubuntu Pro)Upgrade gpg (Ubuntu Pro)Upgrade gnupg (Ubuntu Pro)Upgrade gnupg2Upgrade gnupgUpgrade gnupg2 (Ubuntu Pro) | Apr 4, 2025 | Mar 19, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub