EUVD-2026-18815
GHSA-4pr8-8cvj-qg4h
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Signature verification
|
| Impact | This is a low-severity denial of service with constrained real-world impact. The CVSS 4.0 score reflects limited attack surface: local-only access requirement (AV:L), no authentication bypass, no confidentiality or integrity impact, and only availability degradation (A:L) limited to the rpm process. The EPSS probability would likely be low given the local-only requirement and need for specific file placement. No CISA KEV status, no public exploit code, and no active exploitation reported reduce operational priority. However, SSVC decision framework considerations include: exploitation status (not confirmed exploited), low technical impact (DoS only, not RCE), and non-automatable attack chain (requires local access and deliberate RPM placement). This is a patch-when-available maintenance priority rather than an emergency incident response trigger, particularly relevant in containerized environments where untrusted local actors have less common access. |
| Exploit ScenarioDerived | An attacker with local filesystem access places a specially crafted RPM file in a package repository or staging directory. When a system administrator or automated tooling initiates RPM signature verification (via dnf, rpm, or similar tools), the malicious file triggers the parser error, causing the rpm process to exit abruptly. This blocks legitimate package updates or installations until the malicious file is removed, creating a localized denial of service affecting system patch management. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 03, 2026
Denial of service in rust-rpm-sequoia allows local attackers to crash RPM signature verification by submitting specially crafted RPM files that trigger unhandled errors in OpenPGP parsing, preventing legitimate package management operations. CVSS 4.0 (low severity), local attack vector, non-authenticating. No public exploit code or active exploitation confirmed.
RemediationAI
Apply the security update for rust-rpm-sequoia when released by Red Hat. Systems running Red Hat Enterprise Linux 9 and 10 should check Red Hat's security advisory at https://access.redhat.com/security/cve/CVE-2026-2625 for patched package versions. As an interim mitigation, restrict filesystem access to directories where RPM packages are staged for signature verification to trusted administrators only, and avoid processing RPM files from untrusted or unverified sources. Monitor system logs for unexpected rpm process terminations as a detection indicator.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
rust-rpm-sequoia is a Rust library implementing RPM package signature verification using OpenPGP cryptographic standards. The vulnerability stems from improper error handling (CWE-347: Improper Verification of Cryptographic Signature) in the OpenPGP signature parsing code path. When processing a maliciously constructed RPM file during signature validation, the parser encounters an error condition that is not gracefully caught, causing unconditional process termination. This affects Red Hat Enterprise Linux 9 and 10, and Red Hat Hardened Images 1, which rely on rust-rpm-sequoia for cryptographic package authentication. The local-only attack vector (AV:L) indicates the attacker must have local file system access or the ability to place a crafted RPM in a location where the target system will attempt verification.
Know when Jwt Attack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager (RPM) file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an unconditional termination of the rpm process. This issue results in an application level denial of service, making the system unable to process RPM files for signature verification.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)NVD
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in WSO2 API Manager and related components (Universal Gateway, Traffic Manager, API Control Plane,
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
Security feature bypass in Microsoft .NET (shipped via Visual Studio 2022 17.12/17.14 and Visual Studio 2026 18.7) lets
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
Authentication and authorization bypass in fast-jwt 6.2.0 through 6.2.4 (npm, NearForm) lets a remote, unauthenticated a
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
Exploit-DB