rPGP affected by crash in message handling for deeply nested messages

published 2026-02-13 9mo ago modified 2026-02-13 9mo ago

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

### Summary Previous rPGP versions could be caused to crash with a "stack overflow" when parsing messages that contain deeply nested message layers, such as messages with many signatures.

rPGP 0.19.0 resolves this issue with a more robust message handling implementation (via https://github.com/rpgp/rpgp/pull/625).

### Impact An attacker could cause applications to crash in rPGP's message parsing subsystem, when applications attempt to ingest messages.

### Attribution Discovered internally during rPGP development, using a fuzz test suite previously contributed by Christian Reitter.

Patch / fix

fixed in 1 links 2

crates.io pgp 0.19.0

github.com/rpgp/rpgp@e82f2c7 commit
github.com/rpgp/rpgp#625 pull request

Is GHSA-8h58-w33p-wq3g in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
crates.io	pgp	>=0.16.0-alpha.0, <0.19.0	0.19.0

Classification

Weakness

CWE-121 Stack-based Buffer Overflow

References

Sources

GitHub Advisory GHSA-8h58-w33p-wq3g

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.