CVE-2024-53856: rPGP Panics on Malformed Untrusted Input

Description

rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows an attacker to trigger rpgp crashes by providing crafted data. This vulnerability is fixed in 0.14.1.

Scores

CVSS scores of CVE-2024-53856, by who scored it
Scored by	CVSS	Score	Vector
GitHub_MCNA (assigner)	3.1	High7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVDNVD · Deferred	3.1	High7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS (exploitation in 30 days): 0.47% · top 59% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

CWE-130: Improper Handling of Length Parameter Inconsistency (opens in a new tab)All about CWE-130 and its CVEs
CWE-148: Improper Neutralization of Input Leaders (opens in a new tab)All about CWE-148 and its CVEs
CWE-617: Reachable Assertion (opens in a new tab)All about CWE-617 and its CVEs

Affected products

rpgp · rpgp
- affected < 0.14.1

Affected packages

From reviewed advisories of the GitHub Advisory Database.

crates.iopgpGHSA-9rmp-2568-59rv (opens in a new tab)

References (1)

https://github.com/rpgp/rpgp/security/advisories/GHSA-9rmp-2568-59rv (opens in a new tab)x_refsource_CONFIRM

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2024-53856](https://trackcve.app/badge/CVE-2024-53856.svg)](https://trackcve.app/cve/CVE-2024-53856)

Record last updated 9 Dec 2024, 20:23 UTC.