Listen to this Post
How the CVE Works
The vulnerability (CVE-2025-XXXX) in `sequoia-openpgp` (v1.13.0 to v1.21.0) arises during `RawCertParser` operations when parsing malformed OpenPGP certificates. If an unsupported primary key type is encountered, the parser enters an infinite loop, repeatedly generating the error message “Reading a cert: Invalid operation: Not a Key packet”. This leads to a denial of service (DoS) by exhausting system resources, though it requires an attacker to supply a crafted certificate.
DailyCVE Form
Platform: Rust crate
Version: 1.13.0-1.21.0
Vulnerability: Infinite loop
Severity: Low
Date: Jul 27, 2025
Prediction: Patch expected by Aug 10, 2025
What Undercode Say
Check installed version: cargo tree | grep sequoia-openpgp Mitigation (upgrade): cargo update sequoia-openpgp
How Exploit
Craft a malicious OpenPGP cert with an unsupported key type to trigger infinite parsing.
Protection from this CVE
Upgrade to `sequoia-openpgp` >= v1.21.0.
Impact
Local or remote DoS via resource exhaustion.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
