Sequoia PGP CVE-2025-67897
MEDIUMAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft short-ciphertext PKESK/SKESK packet
-
ExploitSend encrypted message to victim
-
ImpactVictim app decrypts and panics (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Signed/unsigned conversion safety
|
| Exploitation Conditions | Exploitation requires the victim to decrypt or otherwise process an attacker-supplied OpenPGP message whose PKESK or SKESK session-key packet contains an AES key-wrap ciphertext that is too short, triggering a panic in aes_key_unwrap. Affected: any application built on Sequoia openpgp before 2.1.0. No authentication is required (PR:N), but exploitation is limited by required user interaction (UI:R) - the target must actually attempt to decrypt the malicious message - and impact is confined to a crash (availability only); there is no code execution or data disclosure. |
| Impact | This is a moderate-severity denial-of-service issue, not a high-priority emergency. The NVD CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.3) correctly limits impact to availability only (A:H) with no confidentiality or integrity impact - the bug is a Rust panic (CWE-195, signed-to-unsigned conversion / integer underflow leading to an out-of-bounds length) in aes_key_unwrap when handling a too-short ciphertext. All exploitation signals point to low real-world urgency: there is no CISA KEV listing, no public exploit code referenced, and no EPSS score supplied in the input. One signal is worth flagging as questionable: NVD rates AC:H, but crafting an undersized ciphertext in a PKESK/SKESK packet is trivial, so attack complexity is arguably LOW - the real brake on exploitation is UI:R (a victim must actually decrypt the attacker's message), not complexity. Net: a genuine but self-contained crash bug in applications built on the Sequoia OpenPGP library; worth patching promptly but it does not enable code execution or data compromise, and there is no evidence of active exploitation. |
| Exploit ScenarioDerived | An attacker composes an OpenPGP-encrypted message for a victim in which the session-key packet (PKESK or SKESK) carries a deliberately truncated AES key-wrap ciphertext. When the victim's application uses Sequoia (openpgp < 2.1.0) to decrypt the message, aes_key_unwrap panics and the application crashes. No public proof-of-concept is referenced, but the malformed packet is simple to produce by hand. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Denial of service in Sequoia PGP before 2.1.0 allows a remote, unauthenticated attacker (CVSS vector PR:N) to crash any application built on the sequoia-openpgp crate by sending a victim an OpenPGP message whose PKESK or SKESK session-key packet carries an AES key-wrap ciphertext that is shorter than the algorithm requires; the undersized input drives aes_key_unwrap into a panic. Exploitation is constrained by user interaction (UI:R) - the target must actually attempt to decrypt or otherwise process the malicious message - and impact is limited to availability, with no code execution, data disclosure, or integrity loss. This is a moderate-severity availability issue rather than a high-priority emergency, and no public exploit identified at time of analysis; Sequoia 2.1.0 contains the upstream fix.
RemediationAI
Vendor-released patch: upgrade to Sequoia PGP / sequoia-openpgp 2.1.0, which is the first release containing the fix; the upstream commit is b59886e5e7bdf7169ed330f309a6633d131776e5 and the release notes documenting the correction are in the project's openpgp NEWS file at gitlab.com/sequoia-pgp/sequoia/-/blob/b59886e5e7bdf7169ed330f309a6633d131776e5/openpgp/NEWS#L7-L26, with Debian-specific tracking at bugs.debian.org/1122582 so that distributions rebuild dependent packages against the corrected library. Because the flaw lives in a library, applications that statically link or vendor Sequoia must be recompiled and redeployed - updating a distribution package alone will not patch an application built against an older vendored copy. Where immediate upgrade is impossible, effective compensating controls are architectural: isolate decryption of untrusted OpenPGP data into a separate, short-lived worker process supervised for automatic restart, so a panic degrades one message-handling task instead of a long-running service (trade-off: added process-management complexity and a brief availability gap on each crash); and wrap the decryption entry point in Rust's panic-catching mechanism (std::panic::catch_unwind) so the failure is converted to a handled error (trade-off: ineffective if the build uses panic = "abort", which must be changed to unwinding first). Deployments that do not require v6 PKESK/SKESK interoperability can additionally reject v6 messages that carry AES-key-wrapped session keys at the application boundary, at the cost of losing standards-compliant v6 message handling. Note that no patch-free alternative fully removes the exposure, since the trigger is legitimate-looking ciphertext processed on the normal decrypt path.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in cargo
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Sequoia is a Rust implementation of OpenPGP that is consumed both as the standalone sequoia-pgp tooling and, more commonly, as the sequoia-openpgp crate embedded in mail clients, package managers, and other software that must parse and decrypt OpenPGP data. The vulnerable path is session-key handling: modern (v6) PKESK and SKESK packets can transport the message's symmetric session key wrapped with AES Key Wrap (RFC 3394), which requires an input of at least 16 bytes plus the 8-byte integrity check register. Sequoia's aes_key_unwrap did not validate the declared ciphertext length before unwrapping it. The assigned weakness, CWE-195 (Signed to Unsigned Conversion Error), is consistent with a length or slice bound being derived from an unchecked value inside the Rust routine, so a truncated ciphertext produces an out-of-range computation and a panic instead of a recoverable parse error. Because Rust panics unwind (or abort, depending on build profile) and the unwrap call sits on the ordinary decryption path, the failure escapes as a process-level crash rather than a handled error. The reference list points to Debian bug 1122582 and to the upstream fix commit b59886e5e7bdf7169ed330f309a6633d131776e5, whose NEWS fragment documents the correction in the 2.1.0 release; no CPE strings were supplied with the advisory, so affected scope must be derived from the project and its downstream packages.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Crafting a short ciphertext is trivial (AC:L, not NVD's AC:H); victim must decrypt the message (UI:R); unauthenticated (PR:N); crash-only, so C:N/I:N/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a victim an encrypted message with a crafted PKESK or SKESK packet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
GitHub PoC
Exploit-DB