CVE-2025-30258

In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS."

Open

LOW (1.6)

System detected CVE-2025-30258 with a risk of 0.85
main
S
Sebastian Kawelke updated the risk assessment from 0.85 to 1.65
attest
Confidentiality Requirement updated: high -> low, Availability Requirement updated: low -> high
S
Sebastian Kawelke updated the risk assessment from 0.85 to 1.65
attesting
Confidentiality Requirement updated: high -> low, Availability Requirement updated: low -> high
System fixed CVE-2025-30258
attesting
System fixed CVE-2025-30258
attest
System detected CVE-2025-30258 with a risk of 1.65
attesting

Add a comment

Last calculated at:

Affected component

debian/gnupg2

Installed version:

2.2.40

Fixed in:

no patch available

Show in dependency graph

🛡️ DevGuard
Group
/🧩 DevGuard Action
Repository

CVE-2025-30258

Add a comment

Affected component

Management decisions across the organization