Bug 2433463 (CVE-2026-24883) - CVE-2026-24883 GnuPG: GnuPG: Denial of service due to specially crafted signature packet
Summary: CVE-2026-24883 GnuPG: GnuPG: Denial of service due to specially crafted signa...
Keywords:
Status: NEW
Alias: CVE-2026-24883
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2433667 2433668 2433671 2433682
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-01-27 19:01 UTC by OSIDB Bzimport
Modified: 2026-01-28 16:46 UTC (History)
8 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-01-27 19:01:17 UTC 
In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set to a NULL value, leading to a denial of service (application crash).
Comment 2 Jakub Jelen 2026-01-28 16:46:56 UTC 
This does not affect any RHEL nor Fedora versions. This bug was introduced in https://dev.gnupg.org/rG36dbca3e6944d13e75e96eace634e58a7d7e201d which is only in the GnuPG 2.5.x versions per https://dev.gnupg.org/T8049

Please, adjust accordingly. I will close the Fedora trackers.
Note You need to log in before you can comment on or make changes to this bug.