Description
A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager (RPM) file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an unconditional termination of the rpm process. This issue results in an application level denial of service, making the system unable to process RPM files for signature verification.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Hardened Images | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rust-rpm-sequoia | 1.10.2-1 | — |
| Debian 13 | rust-rpm-sequoia | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | rust-rpm-sequoia | No fix yet | — |
| Ubuntu 26.04 LTS | rust-rpm-sequoia | No fix yet | — |
| Ubuntu 25.10 | rust-rpm-sequoia | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | rpm-sequoia +2 | 1.10.1.1-1.2.hum1 | RHSA-2026:94791, RHSA-2026:12682 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | py3-pysequoia | 0.1.34-r0 | — |
| Alpine v3.24 | sequoia-chameleon-gnupg | 0.13.1-r2 | — |
| Alpine v3.24 | sequoia-sq | 1.3.1-r4 | — |
| Alpine v3.24 | sequoia-sqv | 1.3.0-r2 | — |
| Alpine v3.23 | sequoia-chameleon-gnupg | 0.13.1-r1 | — |
| Alpine v3.23 | sequoia-sq | 1.3.1-r2 | — |
| Alpine v3.23 | sequoia-sqv | 1.3.0-r1 | — |
Advisories 3
- RHSA-2026:94791 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-1328 Red Hat Hardened Images RPMs: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2026
- RHSA-2026:12682 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 6, 2026
References
- RHSA-2026:12682 vendor-advisory
- RHSA-2026:94791 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-2625 vdb-entry
- RHBZ#2440357 issue-tracking