What’s Vulnerable › Vulnerabilities

CVE-2025-30258

• Severity: medium (CVSS 4.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-03-19 · updated 2026-06-17
• Weakness: CWE-754

Description

In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS."

Affected products

• GnuPG: before 2.4.8; from 2.5.0 before 2.5.5 — fixed in 2.4.8, 2.5.5

How to fix

Upgrade to a fixed version: GnuPG 2.4.8, 2.5.5. Check the vendor advisory for mitigations.

References

• https://dev.gnupg.org/T7527
• https://dev.gnupg.org/rG48978ccb4e20866472ef18436a32744350a65158
• https://lists.gnupg.org/pipermail/gnupg-announce/2025q1/000491.html

Get alerted when CVE-2025-30258 or the next vulnerability affects your stack