GnuPG CVE-2025-68973

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 23:07 vuln.today

DescriptionCVE.org

Alpine Linux: gnupg fixed in 2.4.9-r0

AnalysisAI

GnuPG on Alpine Linux was patched in package version 2.4.9-r0, addressing an unspecified vulnerability tracked as CVE-2025-68973. The nature of the vulnerability - including attack vector, impact class, and affected functionality - is not disclosed in available intelligence sources. No CVSS score, CWE classification, or technical description has been published, making independent severity assessment impossible at this time. No public exploit or CISA KEV listing has been identified.

Technical ContextAI

GnuPG (GNU Privacy Guard) is a widely used open-source implementation of the OpenPGP standard, providing cryptographic signing, encryption, and authentication capabilities. The vulnerability was remediated in Alpine Linux's GnuPG package at version 2.4.9-r0, which corresponds to an upstream GnuPG release or Alpine-specific packaging fix. The root cause class (CWE) has not been disclosed, and no CPE string was provided in the available intelligence. The Alpine Linux vendor is the sole reporting source, suggesting this may be an Alpine-specific packaging issue or a disclosure coordinated through the Alpine security advisory process rather than upstream GnuPG directly.

Affected ProductsAI

Alpine Linux systems running GnuPG versions prior to the patched package release 2.4.9-r0 are confirmed affected per the Alpine vendor advisory. The exact upstream GnuPG version range affected has not been disclosed. No CPE strings were provided in available intelligence. The specific Alpine Linux release branches (e.g., edge, v3.x) affected have not been enumerated in available data. Users should consult the Alpine Linux security tracker for advisory details.

RemediationAI

Upgrade the Alpine Linux GnuPG package to version 2.4.9-r0 or later by running 'apk upgrade gnupg' on affected Alpine Linux systems. This is the vendor-confirmed fix per the Alpine security advisory. No alternative workarounds have been identified in available data, as no technical description of the vulnerability was published to inform targeted mitigations. If immediate patching is not feasible and GnuPG is used in sensitive contexts such as automated signing or key management, consider restricting access to GnuPG-dependent processes to trusted users and monitoring for anomalous cryptographic operations until the patch can be applied. No side effects of the upgrade have been documented in available intelligence.