{"id":"CVE-2025-67897","revision":"41671228c7d945dea5318bbbb95bc421","records":[{"revision":"41671228c7d945dea5318bbbb95bc421","observedAt":"2026-10-25T04:17:10.72+00:00","statement":{"source":"nvd","id":"CVE-2025-67897","aliases":[],"title":"In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a victim an encrypted message with a crafted PKESK or SKESK packe…","description":"In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a victim an encrypted message with a crafted PKESK or SKESK packet.","state":0,"publishedAt":"2025-12-14T05:16:06.453+00:00","modifiedAt":"2026-10-14T13:10:00.187+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · cve@mitre.org · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","score":5.3,"severity":"MEDIUM"}],"references":["https://bugs.debian.org/1122582","https://gitlab.com/sequoia-pgp/sequoia/-/blob/b59886e5e7bdf7169ed330f309a6633d131776e5/openpgp/NEWS#L7-L26","https://gitlab.com/sequoia-pgp/sequoia/-/commit/b59886e5e7bdf7169ed330f309a6633d131776e5"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-67897","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-195"],"productCriteria":[],"sourceDates":{"published":"2025-12-14T05:16:06.453","lastModified":"2026-10-14T13:10:00.187"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2025-67897","identifiers":["CVE-2025-67897"]},"retained":false,"historicalAffected":[]}],"coverage":[]}