CVE-2025-30258

In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS."

References

Affected packages

Git /

Affected ranges

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-30258.json"

unresolved_ranges

[
    {
        "events":  [
            {
                "introduced":  "0"
            },
            {
                "fixed":  "2.4.8"
            }
        ]
    },
    {
        "events":  [
            {
                "introduced":  "2.5.0"
            },
            {
                "fixed":  "2.5.5"
            }
        ]
    }
]