CVE-2024-53856

7.5 highEPSS 0.5%

High (7.5). EPSS 0.5% chance of exploitation in the next 30 days. Fixed in pgp 0.14.1.

rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows an attacker to trigger rpgp crashes by providing crafted data. This vulnerability is fixed in 0.14.1.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 40% of CVEs (scores of 2026-10-31)
CWEs: CWE-130, CWE-148, CWE-617
Published: 2024-12-05
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-9rmp-2568-59rv	crates.io	pgp	<0.14.1	0.14.1
RUSTSEC-2024-0447	crates.io	pgp	>=0.0.0-0 <0.14.1	0.14.1

References

https://github.com/rpgp/rpgp/security/advisories/GHSA-9rmp-2568-59rv

Check your stack JSON