GHSA-9344-p847-qm5c CVE-2024-58261 RUSTSEC-2024-0345

Low severity (DoS) vulnerability in sequoia-openpgp

High crates.io

Severity: 2.9 / 10; High · CVSS 3.1
Exploit chance (EPSS): 0.43%; Chance of exploitation in the next 30 days. Higher than 37.06% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
Fix: 1.21.0; Upgrade sequoia-openpgp to this version or later

Description

There is a denial-of-service vulnerability in sequoia-openpgp, our crate providing a low-level interface to our OpenPGP implementation. When triggered, the process will enter an infinite loop.

Many thanks to Andrew Gallagher for disclosing the issue to us.

Impact

Any software directly or indirectly using the interface sequoia_openpgp::cert::raw::RawCertParser. Notably, this includes all software using the sequoia_cert_store crate.

Details

The RawCertParser does not advance the input stream when encountering unsupported cert (primary key) versions, resulting in an infinite loop.

The fix introduces a new raw-cert-specific cert::raw::Error::UnuspportedCert.

Affected software

sequoia-openpgp 1.13.0
sequoia-openpgp 1.14.0
sequoia-openpgp 1.15.0
sequoia-openpgp 1.16.0
sequoia-openpgp 1.17.0
sequoia-openpgp 1.18.0
sequoia-openpgp 1.19.0
sequoia-openpgp 1.20.0
Any software built against a vulnerable version of sequoia-openpgp which is directly or indirectly using the interface sequoia_openpgp::cert::raw::RawCertParser. Notably, this includes all software using the sequoia_cert_store crate.

Affected versions

crates.io

Package	Vulnerable	Fixed in
sequoia-openpgp	`>= 1.13.0, < 1.21.0`	`1.21.0`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

sequoia-openpgp crates.io → `1.21.0`

cargo

cargo update -p sequoia-openpgp --precise 1.21.0

Severity breakdown

CVSS 3.1 2.9

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack vector: Local
Attack complexity: High
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: Low

Weakness

CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2024-58261

Packages

Timeline

Jun 26, 2024 Published
Jun 17, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-v6x3-9r38-r27q Sequoia PGP has Subtraction Overflow when aes_key_unwrap function is provided ciphertext that is too short	Medium	Also affects sequoia-openpgp
GHSA-25mx-8f3v-8wh7 sequoia-openpgp vulnerable to out-of-bounds array access leading to panic	Medium	Also affects sequoia-openpgp
GHSA-5849-834g-hvw5 pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search	High	Same weakness, CWE-835
GHSA-mfr5-77xh-9j7h pypdf has possible infinite loop when cloning dictionaries	High	Same weakness, CWE-835
GHSA-h6cr-wjv9-3cpp Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)	Low	Same weakness, CWE-835
GHSA-fw5c-8223-6h42 russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)	Medium	Same weakness, CWE-835
EEF-CVE-2026-115269 HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit	Not rated yet	Same weakness, CWE-835
GHSA-3j72-p6qg-6xp7 Pillow: TarIO negative size field causes infinite CPU-spin loop	Medium	Same weakness, CWE-835

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor