CVE-2025-30258

In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS."

Open

LOW (1.6)

T
Tim Bastin detected CVE-2025-30258 with a risk of 1.25
main
System fixed CVE-2025-30258
main
System detected CVE-2025-30258 with a risk of 1.25
main
System fixed CVE-2025-30258
main
System detected CVE-2025-30258 with a risk of 1.25
main
T
Tim Bastin
attest
S
Sebastian Kawelke updated the risk assessment from 1.25 to 1.65
attest
Confidentiality Requirement updated: medium -> low, Integrity Requirement updated: medium -> high, Availability Requirement updated: medium -> high
System fixed CVE-2025-30258
attest
System detected CVE-2025-30258 with a risk of 1.65
attest

Add a comment

Last calculated at:

Affected component

debian/gnupg2

Installed version:

2.2.40

Fixed in:

no patch available

Show in dependency graph

🛡️ DevGuard
Group
/🧩 DevGuard CI-Components
Repository

CVE-2025-30258

Add a comment

Affected component

Management decisions across the organization