GHSA-g97w-mw7g-v3jv
Duplicate Advisory: Low severity (DoS) vulnerability in sequoia-openpgp
- Severity
- 2.9 / 10
- Low · CVSS 3.1
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
- Fix
1.21.0- Upgrade sequoia-openpgp to this version or later
Description
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-9344-p847-qm5c. This link is maintained to preserve external references.
Original Description
The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of "Reading a cert: Invalid operation: Not a Key packet" messages for RawCertParser operations that encounter an unsupported primary key type.
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| sequoia-openpgp | >= 1.13.0, < 1.21.0 |
1.21.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
sequoia-openpgp crates.io → 1.21.0
- cargo
cargo update -p sequoia-openpgp --precise 1.21.0
Severity breakdown
CVSS 3.1 2.9
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Attack vector
- Local
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Weakness
CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Withdrawn
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-v6x3-9r38-r27q Sequoia PGP has Subtraction Overflow when aes_key_unwrap function is provided ciphertext that is too short | Medium | Also affects sequoia-openpgp |
| GHSA-9344-p847-qm5c Low severity (DoS) vulnerability in sequoia-openpgp | High | Also affects sequoia-openpgp |
| GHSA-25mx-8f3v-8wh7 sequoia-openpgp vulnerable to out-of-bounds array access leading to panic | Medium | Also affects sequoia-openpgp |
| GHSA-5849-834g-hvw5 pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search | High | Same weakness, CWE-835 |
| GHSA-mfr5-77xh-9j7h pypdf has possible infinite loop when cloning dictionaries | High | Same weakness, CWE-835 |
| GHSA-h6cr-wjv9-3cpp Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891) | Low | Same weakness, CWE-835 |
| GHSA-fw5c-8223-6h42 russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang) | Medium | Same weakness, CWE-835 |
| EEF-CVE-2026-115269 HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit | Not rated yet | Same weakness, CWE-835 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor