CVE catalog

CVE-2026-2625

A flaw was found in rust-rpm-sequoia. An attacker can…

A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager (RPM) file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an unconditional termination of the rpm process. This issue results in an application level denial of service, making the system unable to process RPM files for signature verification. rust-rpm-sequoia: rust-rpm-sequoia: Denial of Service via crafted RPM file during signature verification This MODERATE impact application level denial of service vulnerability. A specially crafted RPM file can trigger a Rust panic during OpenPGP signature verification, causing the rpm process to abort. This issue can be exploited without privileges or user interaction by processing a malicious RPM file, for example, via `rpm -Kv` or `rpm --checksig`. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Severity: Medium · CVSS 4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published: Feb 17, 2026, 12:34:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.08% · Oct 27, 2026

Projects and upstream resources

[rust-sequoia-keystore-server][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debian14	rust-rpm-sequoia	`1.10.0-1`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-2625]Oct 1, 2026, 3:03:09 AM UTC
Debian14	rust-rpm-sequoia	`1.10.1-1`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-2625]Oct 1, 2026, 3:03:09 AM UTC
Debian14	rust-rpm-sequoia	`1.10.1-2`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-2625]Oct 1, 2026, 3:03:09 AM UTC
Debian14	rust-rpm-sequoia	`1.10.2-1`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-2625]Oct 1, 2026, 3:03:09 AM UTC
Debian14	rust-rpm-sequoia	`1.8.0-2`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-2625]Oct 1, 2026, 3:03:09 AM UTC
Debian14	rust-rpm-sequoia	`1.9.0-1`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-2625]Oct 1, 2026, 3:03:09 AM UTC
Debian13	rust-rpm-sequoia	`1.10.0-1`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-2625]Oct 1, 2026, 3:03:09 AM UTC
Debian13	rust-rpm-sequoia	`1.10.1-1`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-2625]Oct 1, 2026, 3:03:09 AM UTC
Debian13	rust-rpm-sequoia	`1.10.1-2`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-2625]Oct 1, 2026, 3:03:09 AM UTC
Debian13	rust-rpm-sequoia	`1.10.2-1`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-2625]Oct 1, 2026, 3:03:09 AM UTC
Debian13	rust-rpm-sequoia	`1.10.3-1`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-2625]Oct 1, 2026, 3:03:09 AM UTC
Debian13	rust-rpm-sequoia	`1.8.0-2`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-2625]Oct 1, 2026, 3:03:09 AM UTC

Showing 12 observations. All 16 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
UnknownRelease not reported	enterprise_linux	Not reported	UnknownSource applicability is not established	Provider not reported
UnknownRelease not reported	hardened_images	Not reported	UnknownSource applicability is not established	Provider not reported
UnknownRelease not reported	rpm-sequoia	Not reported	UnknownSource applicability is not established	Provider not reported
Debian13	rust-rpm-sequoia	`1.10.0-1`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-2625]Oct 1, 2026, 3:03:09 AM UTC
Debian13	rust-rpm-sequoia	`1.10.1-1`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-2625]Oct 1, 2026, 3:03:09 AM UTC
Debian13	rust-rpm-sequoia	`1.10.1-2`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-2625]Oct 1, 2026, 3:03:09 AM UTC
Debian13	rust-rpm-sequoia	`1.10.2-1`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-2625]Oct 1, 2026, 3:03:09 AM UTC
Debian13	rust-rpm-sequoia	`1.10.3-1`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-2625]Oct 1, 2026, 3:03:09 AM UTC
Debian13	rust-rpm-sequoia	`1.8.0-2`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-2625]Oct 1, 2026, 3:03:09 AM UTC
Debian13	rust-rpm-sequoia	`1.9.0-1`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-2625]Oct 1, 2026, 3:03:09 AM UTC
Debian14	rust-rpm-sequoia	`1.10.0-1`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-2625]Oct 1, 2026, 3:03:09 AM UTC
Debian14	rust-rpm-sequoia	`1.10.1-1`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-2625]Oct 1, 2026, 3:03:09 AM UTC
Debian14	rust-rpm-sequoia	`1.10.1-2`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-2625]Oct 1, 2026, 3:03:09 AM UTC
Debian14	rust-rpm-sequoia	`1.10.2-1`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-2625]Oct 1, 2026, 3:03:09 AM UTC
Debian14	rust-rpm-sequoia	`1.8.0-2`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-2625]Oct 1, 2026, 3:03:09 AM UTC
Debian14	rust-rpm-sequoia	`1.9.0-1`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-2625]Oct 1, 2026, 3:03:09 AM UTC

Original provider fields

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "hardened_images",
      "fixed_version": "",
      "applicability_unknown": true
    },
    {
      "name": "rpm-sequoia",
      "fixed_version": "",
      "applicability_unknown": true
    },
    {
      "name": "enterprise_linux",
      "fixed_version": "",
      "applicability_unknown": true
    },
    {
      "name": "rust-rpm-sequoia",
      "distro": "debian",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "13",
      "versions": [
        "1.10.0-1",
        "1.10.1-1",
        "1.10.1-2",
        "1.10.2-1",
        "1.10.3-1",
        "1.8.0-2",
        "1.9.0-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-2625",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "DEBIAN-CVE-2026-2625",
      "provider_updated_at": "2026-10-01T03:03:09.324410945Z",
      "applicability_unknown": true
    },
    {
      "name": "rust-rpm-sequoia",
      "distro": "debian",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.10.2-1"
            }
          ]
        }
      ],
      "release": "14",
      "versions": [
        "1.10.0-1",
        "1.10.1-1",
        "1.10.1-2",
        "1.8.0-2",
        "1.9.0-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-2625",
      "fixed_version": "1.10.2-1",
      "provider_source": "pypi",
      "provider_record_id": "DEBIAN-CVE-2026-2625",
      "provider_updated_at": "2026-10-01T03:03:09.324410945Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 13 (Trixie)]

[librpm-sequoia-1]Unknown
Source package: [rust-rpm-sequoia]
Details (2)
- 1.8.0-2 · amd64 · trixie
  Affected
  nvd · rust-rpm-sequoia · debian · 13
- 1.8.0-2 · arm64 · trixie
  Affected
  nvd · rust-rpm-sequoia · debian · 13
[librpm-sequoia-dev]Unknown
Source package: [rust-rpm-sequoia]
Details (2)
- 1.8.0-2 · amd64 · trixie
  Affected
  nvd · rust-rpm-sequoia · debian · 13
- 1.8.0-2 · arm64 · trixie
  Affected
  nvd · rust-rpm-sequoia · debian · 13

Observed: Oct 23, 2026, 10:35:09 PM UTC

References

[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]