{"id":"CVE-2025-67897","revision":"401e6df6b5ff421b9f50a799bf4f3fd9","records":[{"revision":"401e6df6b5ff421b9f50a799bf4f3fd9","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-67897","aliases":[],"title":"In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a victim an encrypted message with a crafted PKESK or SKESK packe…","description":"In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a victim an encrypted message with a crafted PKESK or SKESK packet.","state":0,"publishedAt":"2025-12-14T04:35:24.61+00:00","modifiedAt":"2025-12-15T21:29:01.14+00:00","affected":[{"ecosystem":"Vendor product","name":"sequoia","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:cargo/sequoia-openpgp\",\n                    \"product\": \"sequoia\",\n                    \"vendor\": \"sequoia-pgp\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"2.1.0\",\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","score":5.3,"severity":"MEDIUM"}],"references":["https://gitlab.com/sequoia-pgp/sequoia/-/commit/b59886e5e7bdf7169ed330f309a6633d131776e5","https://bugs.debian.org/1122582","https://gitlab.com/sequoia-pgp/sequoia/-/blob/b59886e5e7bdf7169ed330f309a6633d131776e5/openpgp/NEWS#L7-L26"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-67897","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-67897","identifiers":["CVE-2025-67897"]},"retained":false,"historicalAffected":[]}],"coverage":[]}