CVE-2026-2625
Full vulnerability record from the local CVENow database.
Description
A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager (RPM) file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an unconditional termination of the rpm process. This issue results in an application level denial of service, making the system unable to process RPM files for signature verification.
Severity
MEDIUM
CVSS score
5.5
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2026-04-03 19:17:22.340000
Last modified
2026-11-04 06:17:04.383000
View original CVE JSON
{
"id": "CVE-2026-2625",
"sourceIdentifier": "[email protected]",
"published": "2026-04-03T19:17:22.340",
"lastModified": "2026-11-04T06:17:04.383",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager (RPM) file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an unconditional termination of the rpm process. This issue results in an application level denial of service, making the system unable to process RPM files for signature verification."
},
{
"lang": "es",
"value": "Se encontró una falla en rust-rpm-sequoia. Un atacante puede explotar esta vulnerabilidad al proporcionar un archivo de Red Hat Package Manager (RPM) especialmente diseñado. Durante el proceso de verificación de firmas de RPM, este archivo diseñado puede desencadenar un error en el código de análisis de firmas OpenPGP, lo que lleva a una terminación incondicional del proceso rpm. Este problema resulta en una denegación de servicio a nivel de aplicación, haciendo que el sistema sea incapaz de procesar archivos RPM para la verificación de firmas."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat Hardened Images",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rust-rpm-sequoia-main",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"versions": [
{
"version": "1.10.1.1-1.2.hum1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Hardened Images",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rust-rpm-sequoia-main",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"versions": [
{
"version": "1.10.3-0.3.hum1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rust-rpm-sequoia",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rust-rpm-sequoia",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.5,
"impactScore": 1.4
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-08T18:51:58.247478Z",
"id": "CVE-2026-2625",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-347"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:*",
"matchCriteriaId": "87DEB507-5B64-47D7-9A50-3B87FD1E571F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sequoia-pgp:rpm-sequoia:-:*:*:*:*:rust:*:*",
"matchCriteriaId": "278945D7-C832-45A1-90E0-5509A38A3A80"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "D65C2163-CFC2-4ABB-8F4E-CB09CEBD006C"
}
]
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2026:12682",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:94791",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-2625",
"source": "[email protected]",
"tags": [
"Mitigation",
"Third Party Advisory"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440357",
"source": "[email protected]",
"tags": [
"Issue Tracking",
"Third Party Advisory"
]
}
]
}