CVE-2026-42784

Summary

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.

Affected Software

Weaknesses

• CWE-347: Improper Verification of Cryptographic Signature

Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

References

• https://access.redhat.com/security/cve/CVE-2026-42784
• https://bugzilla.redhat.com/show_bug.cgi?id=2464122

• ←Previous
• Next→