VULNERABILITY INTELLIGENCE

CVE-2024-53857

CVSS score7.5 HIGH
EPSS probability0.47%
CISA KEVNot currently listed
Published2024-12-05
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows attackers to trigger resource exhaustion vulnerabilities in rpgp by providing crafted messages. This affects general message parsing and decryption with symmetric keys.

Weakness classification

  • security-advisories@github.com: CWE-770

Primary references