{"id":"GHSA-9rmp-2568-59rv","revision":"666ca99f542542bb8232590f5df82db1","records":[{"revision":"666ca99f542542bb8232590f5df82db1","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"GHSA-9rmp-2568-59rv","aliases":["CVE-2024-53856","RUSTSEC-2024-0447"],"title":"rPGP Panics on Malformed Untrusted Input","description":"During a security audit, [Radically Open Security](https://www.radicallyopensecurity.com/) discovered several reachable edge cases which allow an attacker to trigger `rpgp` crashes by providing crafted data.\n\n### Impact\nWhen processing malformed input, `rpgp` can run into Rust panics which halt the program.\n\nThis can happen in the following scenarios:\n* Parsing OpenPGP messages from binary or armor format\n* Decrypting OpenPGP messages via `decrypt_with_password()`\n* Parsing or converting public keys\n* Parsing signed cleartext messages from armor format\n* Using malformed private keys to sign or encrypt\n\nGiven the affected components, we consider most attack vectors to be reachable by remote attackers during typical use cases of the `rpgp` library. The attack complexity is low since the malformed messages are generic, short, and require no victim-specific knowledge.\n\nThe result is a denial-of-service impact via program termination. There is no impact to confidentiality or integrity security properties.\n\n### Versions and Patches\nAll recent versions are affected by at least some of the above mentioned issues. \n\nThe vulnerabilities have been fixed with version `0.14.1`. We recommend all users to upgrade to this version.\n\n### References\n\n\nThe security audit was made possible by the [NLnet Foundation NGI Zero Core](https://nlnet.nl/core/) grant program [for rpgp](https://nlnet.nl/project/rPGP-cryptorefresh/).","state":0,"publishedAt":"2024-12-05T17:30:52+00:00","modifiedAt":"2025-12-26T17:38:33.900409+00:00","affected":[{"ecosystem":"crates.io","name":"pgp","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.14.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/rpgp/rpgp/security/advisories/GHSA-9rmp-2568-59rv","https://nvd.nist.gov/vuln/detail/CVE-2024-53856","https://github.com/rpgp/rpgp","https://rustsec.org/advisories/RUSTSEC-2024-0447.html"],"sourceUrl":"https://github.com/advisories/GHSA-9rmp-2568-59rv","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-9rmp-2568-59rv","identifiers":["GHSA-9rmp-2568-59rv","CVE-2024-53856","RUSTSEC-2024-0447"]},"retained":false,"historicalAffected":[]}],"coverage":[]}