Vulnerability GHSA-8h58-w33p-wq3g

High Risk

8 months ago

rPGP affected by crash in message handling for deeply nested messages

0.16.0-alpha.0 - 0.18.0

Summary

rPGP affected by crash in message handling for deeply nested messages

Details

Summary

Previous rPGP versions could be caused to crash with a "stack overflow" when parsing messages that contain deeply nested message layers, such as messages with many signatures.

rPGP 0.19.0 resolves this issue with a more robust message handling implementation (via https://github.com/rpgp/rpgp/pull/625).

Impact

An attacker could cause applications to crash in rPGP's message parsing subsystem, when applications attempt to ingest messages.

Attribution

Discovered internally during rPGP development, using a fuzz test suite previously contributed by Christian Reitter.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Medium Risk

8 months ago

rPGP's integrity protection of encrypted data was not always checked

0.16.0-alpha.0 - 0.18.0 GHSA-c7ph-f7jm-xv4w

High Risk

8 months ago

rPGP vulnerable to parser crash on crafted RSA secret key packets through CVE-2026-21895

0.16.0-alpha.0 - 0.18.0 GHSA-7587-4wv6-m68m

High Risk

1 year ago

rPGP Potential Resource Exhaustion when handling Untrusted Messages

0.1.0 - 0.11.0 and 0.13.0 - 0.14.1 GHSA-4grw-m28r-q285

High Risk

1 year ago

rPGP Panics on Malformed Untrusted Input

0.1.0 - 0.11.0 and 0.13.0 - 0.14.0 GHSA-9rmp-2568-59rv

High Risk

1 year ago

Panics on Malformed Untrusted Input

0.1.0 - 0.11.0 and 0.13.0 - 0.14.0 RUSTSEC-2024-0447

View all vulnerabilities for these packages

Impacted packages

Timeline

Published

8 months ago

Fixed (0.19.0)

8 months ago

Last Modified

8 months ago