Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion
Historical advisory recorded 3 Nov 2026 12:57:16 UTC. Read the latest advisory.
cve-program · CVE-2026-42784
PublishedA flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.
Read the publisher's advisoryAffected versions, risk and source history
cve-program · CVE-2026-42784
PublishedSequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion
A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.
- Source published
- 16 Sep 2026 16:56:11 UTC
- Source modified
- 3 Nov 2026 11:47:14 UTC
- Saved here
- 3 Nov 2026 12:57:16 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 3.1 · 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N