CVE-2026-57062 | Low | 2.9 | 2026-06-23 | CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes… |
CVE-2026-41990 | Medium | 4.0 | 2026-04-23 | Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data. |
CVE-2026-41989 | Medium | 6.7 | 2026-04-23 | Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt. |
CVE-2026-24883 | Low | 3.7 | 2026-01-27 | In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set to a NULL value, leading to a denial of se… |
CVE-2026-24882 | High | 8.4 | 2026-01-27 | In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys. |
CVE-2026-24881 | High | 8.1 | 2026-01-27 | In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffer overflow in gpg-a… |
CVE-2025-68973 | High | 7.8 | 2025-12-28 | In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted… |
CVE-2025-68972 | Medium | 5.9 | 2025-12-27 | In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text af… |
CVE-2025-30258 | Low | 2.7 | 2025-03-19 | In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags… |
CVE-2022-3219 | Low | 3.3 | 2023-02-23 | GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a f… |
CVE-2022-3515 | Critical | 9.8 | 2023-01-12 | A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code executi… |
CVE-2022-47629 | Critical | 9.8 | 2022-12-20 | Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser. |
CVE-2022-34903 | Medium | 6.5 | 2022-07-01 | GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of G… |
CVE-2021-40528 | Medium | 5.9 | 2021-09-06 | The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dange… |
CVE-2021-33560 | High | 7.5 | 2021-06-08 | Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_pow… |
CVE-2021-3345 | High | 7.8 | 2021-01-29 | _gcry_md_block_write in cipher/hash-common.c in Libgcrypt version 1.9.0 has a heap-based buffer overflow when the digest final function sets a large count valu… |
CVE-2020-25125 | High | 7.8 | 2020-09-03 | GnuPG 2.2.21 and 2.2.22 (and Gpg4win 3.1.12) has an array overflow, leading to a crash or possibly unspecified other impact, when a victim imports an attacker'… |
CVE-2019-14855 | High | 7.5 | 2020-03-20 | A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create… |
CVE-2015-0837 | Medium | 5.9 | 2019-11-29 | The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information by leveraging timing differences when… |
CVE-2014-3591 | Medium | 4.2 | 2019-11-29 | Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to ob… |
CVE-2011-2207 | Medium | 5.3 | 2019-11-27 | dirmngr before 2.1.0 improperly handles certain system calls, which allows remote attackers to cause a denial of service (DOS) via a specially-crafted certific… |
CVE-2015-1607 | Medium | 5.5 | 2019-11-20 | kbx/keybox-search.c in GnuPG before 1.4.19, 2.0.x before 2.0.27, and 2.1.x before 2.1.2 does not properly handle bitwise left-shifts, which allows remote attac… |
CVE-2015-1606 | Medium | 5.5 | 2019-11-20 | The keyring DB in GnuPG before 2.1.2 does not properly handle invalid packets, which allows remote attackers to cause a denial of service (invalid read and use… |
CVE-2019-13050 | High | 7.5 | 2019-06-29 | Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver confi… |
CVE-2019-12904 | Medium | 5.9 | 2019-06-20 | In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other proce… |
CVE-2018-1000858 | High | 8.8 | 2018-12-20 | GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in Attacker controlled CSRF, Information Dis… |
CVE-2017-7526 | Medium | 6.1 | 2018-07-26 | libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method fo… |
CVE-2018-0495 | Medium | 4.7 | 2018-06-13 | Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding… |
CVE-2018-12020 | High | 7.5 | 2018-06-08 | mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output… |
CVE-2018-9234 | High | 7.5 | 2018-04-04 | GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid cer… |
CVE-2018-6829 | High | 7.5 | 2018-02-07 | cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive… |
CVE-2017-0379 | High | 7.5 | 2017-08-29 | Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cip… |
CVE-2017-9526 | Medium | 5.9 | 2017-06-11 | In Libgcrypt before 1.7.7, an attacker who learns the EdDSA session key (from side-channel observation during the signing process) can easily recover the long-… |
CVE-2016-6313 | Medium | 5.3 | 2016-12-13 | The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easie… |
CVE-2016-4579 | High | 7.5 | 2016-06-13 | Libksba before 1.3.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via unspecified vectors, related to the "returned leng… |
CVE-2016-4574 | High | 7.5 | 2016-06-13 | Off-by-one error in the append_utf8_value function in the DN decoder (dn.c) in Libksba before 1.3.4 allows remote attackers to cause a denial of service (out-o… |
CVE-2016-4356 | High | 7.5 | 2016-06-13 | The append_utf8_value function in the DN decoder (dn.c) in Libksba before 1.3.3 allows remote attackers to cause a denial of service (out-of-bounds read) by cl… |
CVE-2016-4355 | High | 7.5 | 2016-06-13 | Multiple integer overflows in ber-decoder.c in Libksba before 1.3.3 allow remote attackers to cause a denial of service (crash) via crafted BER data, which lea… |
CVE-2016-4354 | High | 7.5 | 2016-06-13 | ber-decoder.c in Libksba before 1.3.3 uses an incorrect integer data type, which allows remote attackers to cause a denial of service (crash) via crafted BER d… |
CVE-2016-4353 | High | 7.5 | 2016-06-13 | ber-decoder.c in Libksba before 1.3.3 does not properly handle decoder stack overflows, which allows remote attackers to cause a denial of service (abort) via… |
CVE-2015-7511 | Low | 2.0 | 2016-04-19 | Libgcrypt before 1.6.5 does not properly perform elliptic-point curve multiplication during decryption, which makes it easier for physically proximate attacker… |
CVE-2014-9087 | | | 2014-12-01 | Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG, allows remote attackers to cause a denial of service (crash) via a… |
CVE-2014-5270 | | | 2014-10-10 | Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization, which makes it ea… |
CVE-2014-4617 | | | 2014-06-25 | The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24 allows context-dependent attackers to cause a denial of service (… |
CVE-2013-4576 | | | 2013-12-20 | GnuPG 1.x before 1.4.16 generates RSA keys using sequences of introductions with certain patterns that introduce a side channel, which allows physically proxim… |
CVE-2013-4402 | | | 2013-10-28 | The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via… |
CVE-2013-4351 | | | 2013-10-10 | GnuPG 1.4.x, 2.0.x, and 2.1.x treats a key flags subpacket with all bits cleared (no usage permitted) as if it has all bits set (all usage permitted), which mi… |
CVE-2013-4242 | | | 2013-08-19 | GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and possibly other products, allows local users to obtain private RSA keys via a cache s… |
CVE-2012-6085 | | | 2013-01-24 | The read_block function in g10/import.c in GnuPG 1.4.x before 1.4.13 and 2.0.x through 2.0.19, when importing a key, allows remote attackers to corrupt the pub… |
CVE-2010-2547 | High | 8.1 | 2010-08-05 | Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16 allows remote attackers to cause a denial of service (crash) and possibl… |
CVE-2008-1530 | | | 2008-03-27 | GnuPG (gpg) 1.4.8 and 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted duplicate keys that ar… |
CVE-2007-1263 | | | 2007-03-06 | GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages… |
CVE-2006-6169 | | | 2006-11-29 | Heap-based buffer overflow in the ask_outfile_name function in openfile.c for GnuPG (gpg) 1.4 and 2.0, when running interactively, might allow attackers to exe… |
CVE-2006-3746 | | | 2006-07-28 | Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial of service (segmentation fault) via a crafted message. |
CVE-2006-3082 | | | 2006-06-19 | parse-packet.c in GnuPG (gpg) 1.4.3 and 1.9.20, and earlier versions, allows remote attackers to cause a denial of service (gpg crash) and possibly overwrite m… |
CVE-2005-0366 | | | 2005-05-02 | The integrity check feature in OpenPGP, when handling a message that was encrypted using cipher feedback (CFB) mode, allows remote attackers to recover part of… |