CVE-2025-30258

Published: Mar 19, 2025Modified: Oct 16, 2025

4.7

Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 1.0 / Impact: 3.6

Source: NVD

Description

In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS."

Affected (2)

Products: Gnupg: Gnupg

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Gnupg Gnupg	Before 2.4.8
Gnupg Gnupg	From 2.5.0 to 2.5.5

Related CWEs

Improper Check for Unusual or Exceptional Conditions

The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

References (3)

https://dev.gnupg.org/T7527

Source: cve@mitre.org

ExploitIssue Tracking

https://dev.gnupg.org/rG48978ccb4e20866472ef18436a32744350a65158

Source: cve@mitre.org

Issue Tracking

https://lists.gnupg.org/pipermail/gnupg-announce/2025q1/000491.html

Source: cve@mitre.org

Mailing ListRelease NotesVendor Advisory

Timeline

No history available yet.