GnuPG CVE-2025-68972

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 23:07 vuln.today

DescriptionCVE.org

Alpine Linux: gnupg fixed in 2.4.9-r0

AnalysisAI

GnuPG on Alpine Linux is affected by a vulnerability addressed in Alpine package version 2.4.9-r0. The CVE record contains only a fix-availability notice from the Alpine Linux vendor with no published description, CVSS scoring, or CWE classification, making the specific vulnerability class, impact, and attack vector unconfirmed at time of analysis. Security teams should treat this as a vendor-confirmed defect warranting patch application, while monitoring upstream GnuPG and Alpine advisories for full disclosure.

Technical ContextAI

GnuPG (GNU Privacy Guard) is an open-source implementation of the OpenPGP standard used for cryptographic signing, encryption, and key management. It is a foundational system component on Alpine Linux, widely used in package verification, secure communications, and secrets handling. The Alpine package version 2.4.9-r0 corresponds to upstream GnuPG 2.4.x with Alpine's revision suffix (-r0 denoting the first Alpine package build of that upstream release). No CWE is assigned, so the root cause class - whether a memory safety issue, cryptographic weakness, input validation flaw, or logic error - cannot be determined from available data. CPE data was not provided in the source intelligence.

Affected ProductsAI

GnuPG as packaged for Alpine Linux is confirmed affected. The fix was released in Alpine package gnupg 2.4.9-r0, which corresponds to upstream GnuPG version 2.4.9. Versions of the gnupg Alpine package prior to 2.4.9-r0 across all Alpine Linux branches that carry the 2.4.x package series should be considered affected. No CPE strings were provided in the source data, and no vendor advisory URL beyond the Alpine source report is available. Affected Alpine branch versions (e.g., edge, 3.x stable) should be verified against the Alpine Linux package tracker at pkgs.alpinelinux.org.

RemediationAI

Upgrade the gnupg package on Alpine Linux to version 2.4.9-r0 or later by running 'apk upgrade gnupg' on affected systems. This is the only confirmed remediation action; no workarounds are documented in available data. For systems where immediate patching is not possible, consider restricting access to gnupg-dependent workflows (e.g., package signature verification pipelines, GPG-signed artifact processing) as a temporary measure, though the trade-off is disruption to those operations. Monitor the Alpine Linux security tracker (https://security.alpinelinux.org) and the upstream GnuPG project (https://gnupg.org/download/index.html) for a full advisory with further guidance. No patch version beyond the Alpine package designation 2.4.9-r0 has been independently confirmed from this data.