Gnupg
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Gnupg.
By the Year
In 2025 there have been 0 vulnerabilities in Gnupg. Gnupg did not have any published security vulnerabilities last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2025 | 0 | 0.00 |
| 2024 | 0 | 0.00 |
| 2023 | 2 | 6.55 |
| 2022 | 1 | 6.50 |
| 2021 | 0 | 0.00 |
| 2020 | 1 | 7.50 |
| 2019 | 1 | 7.50 |
| 2018 | 3 | 7.93 |
It may take a day or so for new Gnupg vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Gnupg Security Vulnerabilities
GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached
CVE-2022-3219
3.3 - Low
- February 23, 2023
GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.
Memory Corruption
A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser
CVE-2022-3515
9.8 - Critical
- January 12, 2023
A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment.
Integer Overflow or Wraparound
GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information
CVE-2022-34903
6.5 - Medium
- July 01, 2022
GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line.
Injection
A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm
CVE-2019-14855
7.5 - High
- March 20, 2020
A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.
Inadequate Encryption Strength
Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network
CVE-2019-13050
7.5 - High
- June 29, 2019
Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack.
Improper Certificate Validation
GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr
CVE-2018-1000858
8.8 - High
- December 20, 2018
GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in Attacker controlled CSRF, Information Disclosure, DoS. This attack appear to be exploitable via Victim must perform a WKD request, e.g. enter an email address in the composer window of Thunderbird/Enigmail. This vulnerability appears to have been fixed in after commit 4a4bb874f63741026bd26264c43bb32b1099f060.
Session Riding
mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output
CVE-2018-12020
7.5 - High
- June 08, 2018
mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.
Use of Incorrectly-Resolved Name or Reference
GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications
CVE-2018-9234
7.5 - High
- April 04, 2018
GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey.
Key Management Errors
Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG
CVE-2014-9087
- December 01, 2014
Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG, allows remote attackers to cause a denial of service (crash) via a crafted OID in a (1) S/MIME message or (2) ECC based OpenPGP data, which triggers a buffer overflow.
Integer underflow
The read_block function in g10/import.c in GnuPG 1.4.x before 1.4.13 and 2.0.x through 2.0.19, when importing a key
CVE-2012-6085
- January 24, 2013
The read_block function in g10/import.c in GnuPG 1.4.x before 1.4.13 and 2.0.x through 2.0.19, when importing a key, allows remote attackers to corrupt the public keyring database or cause a denial of service (application crash) via a crafted length field of an OpenPGP packet.
Improper Input Validation
Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16
CVE-2010-2547
8.1 - High
- August 05, 2010
Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a certificate with a large number of Subject Alternate Names, which is not properly handled in a realloc operation when importing the certificate or verifying its signature.
Dangling pointer
