Description
parse-packet.c in GnuPG (gpg) 1.4.3 and 1.9.20, and earlier versions, allows remote attackers to cause a denial of service (gpg crash) and possibly overwrite memory via a message packet with a large length (long user ID string), which could lead to an integer overflow, as demonstrated using the --no-armor option.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | gnupg | 1.2.6-5 | RHSA-2006:0571 |
| RHEL 3 | gnupg | 1.2.1-16 | RHSA-2006:0571 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- GnuPG 1.4.3/1.9.x - Parse_User_ID Remote Buffer Overflow EDB-28077 · dos · Jun 20, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- RHSA-2006:0571 Red Hat Security Advisory: gnupg security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1107 gnupg - integer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1115 gnupg2 - integer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20899 third-party-advisory
- oval:org.mitre.oval:def:10089 vdb-entry signature
- 20968 third-party-advisory
- 20881 third-party-advisory
- http://cvs.gnupg.org/cgi-bin/viewcvs.cgi/trunk/g10/parse-packet.c?rev=4157&r1=4141&r2=4157
- 20060629 rPSA-2006-0120-1 gnupg mailing-list
- 20783 third-party-advisory
- DSA-1107 vendor-advisory
- 20811 third-party-advisory
- SUSE-SR:2006:018 vendor-advisory
- 20060531 RE: GnuPG fun mailing-list
- 21063 third-party-advisory
- 21135 third-party-advisory
- 20829 third-party-advisory
- ADV-2006-2450 vdb-entry
- http://support.avaya.com/elmodocs2/security/ASA-2006-167.htm
- 20060601 Re: GnuPG fun mailing-list
- 20801 third-party-advisory
- 20060531 GnuPG fun mailing-list
- 18554 vdb-entry
- USN-304-1 vendor-advisory
- SUSE-SR:2006:015 vendor-advisory
- RHSA-2006:0571 vendor-advisory
- MDKSA-2006:110 vendor-advisory
- DSA-1115 vendor-advisory
- OpenPKG-SA-2006.010 vendor-advisory
- 21137 third-party-advisory
- 21143 third-party-advisory
- 21585 third-party-advisory
- 1016519 vdb-entry
- SSA:2006-178-02 vendor-advisory
- gnupg-parsepacket-bo(27245) vdb-entry