ALPINE-CVE-2026-2625

See a problem?
Please try reporting it to the source first.
Source
https://security.alpinelinux.org/vuln/CVE-2026-2625
Import Source
https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-2625.json
JSON Data
https://api.osv.dev/v1/vulns/ALPINE-CVE-2026-2625
Upstream
  • CVE-2026-2625
Published
2026-04-03T19:17:22Z
Modified
2026-11-03T06:32:53Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager (RPM) file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an unconditional termination of the rpm process. This issue results in an application level denial of service, making the system unable to process RPM files for signature verification.

References

Affected packages

Alpine:v3.23
sequoia-chameleon-gnupg

Package

Name
sequoia-chameleon-gnupg
Purl
pkg:apk/alpine/sequoia-chameleon-gnupg?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.13.1-r1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-2625.json"
sequoia-sq

Package

Name
sequoia-sq
Purl
pkg:apk/alpine/sequoia-sq?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.3.1-r2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-2625.json"
sequoia-sqv

Package

Name
sequoia-sqv
Purl
pkg:apk/alpine/sequoia-sqv?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.3.0-r1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-2625.json"
Alpine:v3.24
py3-pysequoia

Package

Name
py3-pysequoia
Purl
pkg:apk/alpine/py3-pysequoia?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.1.34-r0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-2625.json"
sequoia-chameleon-gnupg

Package

Name
sequoia-chameleon-gnupg
Purl
pkg:apk/alpine/sequoia-chameleon-gnupg?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.13.1-r2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-2625.json"
sequoia-sq

Package

Name
sequoia-sq
Purl
pkg:apk/alpine/sequoia-sq?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.3.1-r4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-2625.json"
sequoia-sqv

Package

Name
sequoia-sqv
Purl
pkg:apk/alpine/sequoia-sqv?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.3.0-r2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-2625.json"