Read the docs
TI-2026-66229 Aliases GHSA-c7ph-f7jm-xv4w

rPGP's integrity protection of encrypted data was not always checked

Priority LOW 38CWE-354Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

### Summary For some messages, rPGP returned incorrectly decrypted data without signaling that integrity protection was invalid. ### Details When decrypting SEIPD (Symmetrically Encrypted and Integrity Protected Data Packet), rPGP previously did not under all circumstances report the absence of valid integrity protection to callers of the library. ### Impact While the resulting invalid decryption output is not attacker controlled, its contents may be a security concern if an attacker can gain access to it. ### Attribution Discovered internally in the course of rPGP development work.

Why it matters now

Fix Fixed pgp (crates.io): 0.19.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—pgp (crates.io)0.16.0-alpha.0 to before 0.19.00.19.0Patch availableGHSA-c7ph-f7jm-xv4w
  • pgp (crates.io) Vendor— Affected 0.16.0-alpha.0 to before 0.19.0 Fixed in 0.19.0 Patch available GHSA-c7ph-f7jm-xv4w

Remediation

  • Fix · GHSA-c7ph-f7jm-xv4w pgp (crates.io) Fixed in 0.19.0 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-c7ph-f7jm-xv4w

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences