In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS."
CVSS Details
- CVSS 3.1 Base Score: 2.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade gnupg2-debugsourceUpgrade gnupg2-smime-debuginfoUpgrade gnupg2-smimeUpgrade gnupg2-debuginfoUpgrade gnupg2-minimal-debuginfoUpgrade gnupg2Upgrade gnupg2-minimal | Jul 30, 2025 | Mar 19, 2025 |
| Debian | — | Upgrade gnupg2No solution exists | May 15, 2025 | Mar 19, 2025 |
| Dell Powerstore Dsa2026115 | — | Upgrade Dell PowerStoreOS to the latest version | Feb 25, 2026 | Feb 24, 2026 |
| Huawei Euleros 2_0_sp10 | — | Upgrade gnupg2 | Sep 15, 2025 | Aug 9, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade gnupg2 | Aug 13, 2025 | Aug 9, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade gnupg2 | Sep 15, 2025 | Aug 9, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade gnupg2 | Aug 13, 2025 | Aug 9, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 19, 2025 |
| Suse | — | Upgrade gpg2-langUpgrade gpg2Upgrade gpg2-tpmUpgrade dirmngr | Dec 5, 2025 | Jul 1, 2025 |
| Ubuntu | — | Upgrade gnupgUpgrade gnupg2 (Ubuntu Pro)Upgrade gnupg (Ubuntu Pro)Upgrade gnupg2Upgrade gpgv2 (Ubuntu Pro)Upgrade gpgUpgrade gpg (Ubuntu Pro) | Apr 4, 2025 | Mar 19, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub