low2.7
CVE-2025-30258
In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags,…
Impact
In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS."
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gnupg | Gnupg | before 2.4.8 from 2.5.0 before 2.5.5 |