Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion
Historical advisory recorded 10 Nov 2026 16:21:25 UTC. Read the latest advisory.
cve-program · CVE-2026-42784
PublishedA flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.
Read the publisher's advisoryAffected versions, risk and source history
cve-program · CVE-2026-42784
PublishedSequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion
A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.
- Source published
- 16 Sep 2026 16:56:11 UTC
- Source modified
- 10 Nov 2026 14:08:22 UTC
- Saved here
- 10 Nov 2026 16:21:25 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 3.1 · 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N