CVE-2026-2625: Rust-rpm-sequoia: rust-rpm-sequoia: denial of service via crafted rpm file during signature verification

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-03 · updated 2026-07-24
Weakness: CWE-347

Description

A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager (RPM) file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an unconditional termination of the rpm process. This issue results in an application level denial of service, making the system unable to process RPM files for signature verification.

Affected products

Red Hat Enterprise Linux: 9.0, 10.0
RedHat Hardened Images: all versions
sequoia-pgp Rpm-Sequoia: all versions

References

https://access.redhat.com/errata/RHSA-2026:12682
https://access.redhat.com/security/cve/CVE-2026-2625
https://bugzilla.redhat.com/show_bug.cgi?id=2440357

Get alerted when CVE-2026-2625 or the next vulnerability affects your stack