{"id":"CVE-2024-53856","aliases":["GHSA-9rmp-2568-59rv","RUSTSEC-2024-0447"],"url":"https://o3.security/vulnerability/CVE-2024-53856","summary":"rPGP Panics on Malformed Untrusted Input","details":"During a security audit, [Radically Open Security](https://www.radicallyopensecurity.com/) discovered several reachable edge cases which allow an attacker to trigger `rpgp` crashes by providing crafted data.\n\n### Impact\nWhen processing malformed input, `rpgp` can run into Rust panics which halt the program.\n\nThis can happen in the following scenarios:\n* Parsing OpenPGP messages from binary or armor format\n* Decrypting OpenPGP messages via `decrypt_with_password()`\n* Parsing or converting public keys\n* Parsing signed cleartext messages from armor format\n* Using malformed private keys to sign or encrypt\n\nGiven the affected components, we consider most attack vectors to be reachable by remote attackers during typical use cases of the `rpgp` library. The attack complexity is low since the malformed messages are generic, short, and require no victim-specific knowledge.\n\nThe result is a denial-of-service impact via program termination. There is no impact to confidentiality or integrity security properties.\n\n### Versions and Patches\nAll recent versions are affected by at least some of the above mentioned issues. \n\nThe vulnerabilities have been fixed with version `0.14.1`. We recommend all users to upgrade to this version.\n\n### References\n\n\nThe security audit was made possible by the [NLnet Foundation NGI Zero Core](https://nlnet.nl/core/) grant program [for rpgp](https://nlnet.nl/project/rPGP-cryptorefresh/).","published":"2024-12-05T15:24:36.049Z","modified":"2026-08-12T03:51:37.798430584Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":{"score":0.00467,"percentile":0.39439,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"pgp","fixedVersion":"0.14.1"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53856.json"},{"type":"ADVISORY","url":"https://github.com/rpgp/rpgp/security/advisories/GHSA-9rmp-2568-59rv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53856"},{"type":"PACKAGE","url":"https://github.com/rpgp/rpgp"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2024-0447.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:37.798430584Z"}}