4.0 Medium

CVE-2026-2625 Rust-rpm-sequoia: rust-rpm-sequoia: denial of service via crafted rpm file during signature verification

Description

A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager (RPM) file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an unconditional termination of the rpm process. This issue results in an application level denial of service, making the system unable to process RPM files for signature verification.

CVSS 3.1 detail

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Exploitable with local access to the machine, without an account and without any user action; the impact on data or service is limited.

Attack vector: Local
Attack complexity: Low
Privileges required: None
Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: Low

Affected products and versions

Product	Affected versions	Fixed in
Red Hat Enterprise Linux 10	Versions not published
Red Hat Enterprise Linux 9	Versions not published
Red Hat Hardened Images 1	Versions not published
Red Hat Hardened Images 1.10	earliest → < 1.10.3-0.3.hum1	1.10.3-0.3.hum1

References

RHSA-2026:12682 access.redhat.com
RHSA-2026:94791 access.redhat.com
access.redhat.com access.redhat.com
RHBZ#2440357 bugzilla.redhat.com

Timeline

Published April 3, 2026
Last modified November 5, 2026

The 1454 CVEs of Red Hat Enterprise Linux 10 →

CVE-2026-123151 Gdb: gdb: stack buffer overflow in parse_tsv_definition via stale rs->buf tail Not rated CVE-2026-121997 Gdb: gdbserver: heap buffer overflow in cmd_qtdpsrc via qtdpsrc declared/actual length mismatch 8.1 High CVE-2026-121996 Gdb: gdbserver: heap disclosure and wild pointer in gdb_parse_agent_expr via untrusted agent-expression length 8.2 High CVE-2026-121995 Gdb: gdb: stack buffer overflow in parse_tracepoint_definition via stale rs->buf tail 7.5 High

Track this CVE