Summary
It was discovered that Libgcrypt incorrectly handled crafted ECDH
ciphertext. An attacker could possibly use this issue to cause Libgcrypt to
crash, resulting in a denial of service. (CVE-2026-41989)
It was discovered that Libgcrypt incorrectly handled Dilithium signing. An
attacker could possibly use this issue to cause Libgcrypt to crash,
resulting in a denial of service. This issue only affected Ubuntu 26.04
LTS. (CVE-2026-41990)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | libgcrypt20 | 1.9.4-3ubuntu3.2 |
| Ubuntu · 24.04 LTS 24.04:LTS | libgcrypt20 | 1.10.3-2ubuntu0.1 |
| Ubuntu · 25.10 | libgcrypt20 | 1.11.0-7ubuntu0.1 |
| Ubuntu · 26.04 LTS 26.04:LTS | libgcrypt20 | 1.12.0-2ubuntu0.1 |
Vulnerabilities 2
-
Medium 6.7
Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext…
-
Medium 4.0
Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attac…