GnuPG — security advisories

vendor: null1 advisories1 sourcelatest 2026-06-09⚡ RSS feed

Every advisory CSIRTS.com has correlated to GnuPG, newest first — across national CERTs, vendor PSIRTs and vulnerability databases.

⚡ Watch GnuPG

Get an email when a new GnuPG advisory drops — max one per day, one-click unsubscribe.

CVE-2026-57062: CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.

lowCVSS 2.9CVE-2026-57062msrc2026-06-09