A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager (RPM) file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an unconditional termination of the rpm process. This issue results in an application level denial of service, making the system unable to process RPM files for signature verification.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/errata/RHSA-2026:12682 | Third Party Advisory |
| https://access.redhat.com/security/cve/CVE-2026-2625 | Mitigation Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2440357 | Issue Tracking Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
01 May 2026, 21:00
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Redhat
Redhat enterprise Linux Sequoia-pgp Sequoia-pgp rpm-sequoia Redhat hardened Images |
|
| CPE | cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* cpe:2.3:a:sequoia-pgp:rpm-sequoia:-:*:*:*:*:rust:*:* cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:* |
|
| References | () https://access.redhat.com/errata/RHSA-2026:12682 - Third Party Advisory | |
| References | () https://access.redhat.com/security/cve/CVE-2026-2625 - Mitigation, Third Party Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2440357 - Issue Tracking, Third Party Advisory |
01 May 2026, 11:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
03 Apr 2026, 19:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-03 19:17
Updated : 2026-05-01 21:00
NVD link : CVE-2026-2625
Mitre link : CVE-2026-2625
CVE.ORG link : CVE-2026-2625
JSON object : View
Products Affected
redhat
- enterprise_linux
- hardened_images
sequoia-pgp
- rpm-sequoia
CWE
CWE-347
Improper Verification of Cryptographic Signature