Medium severity · published Apr 3, 2026
CVE-2026-2625
Rust-rpm-sequoia: rust-rpm-sequoia: denial of service via crafted rpm file during signature verification
5.5
CVSS
0.1%
EPSS
No
On KEV
Description
A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager (RPM) file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an unconditional termination of the rpm process. This issue results in an application level denial of service, making the system unable to process RPM files for signature verification.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 0% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat Enterprise Linux 10 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 9 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Hardened Images · Red Hat
All versions, or not specified · source: vendor
EL
Enterprise Linux · Redhat
9.0; 10.0 · source: NVD
HI
Hardened Images · Redhat
All versions, or not specified · source: NVD
RP
Rpm-sequoia · Sequoia-pgp
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-2625
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-2625
Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:12682
Mitigation
https://access.redhat.com/security/cve/CVE-2026-2625
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2440357
More from Red Hat Enterprise Linux 10
7.8
CVE-2026-31431
crypto: algif_aead - Revert to operating out-of-place
7.5
CVE-2026-34486
Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor
10.0
CVE-2026-46595
Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
10.0
CVE-2026-34078
Flatpak has a complete sandbox escape leading to host file access and code execution in the host context
10.0
CVE-2026-4692
Sandbox escape in the Responsive Design Mode component