CVE-2024-53857

7.5 highEPSS 0.5%

High (7.5). EPSS 0.5% chance of exploitation in the next 30 days. Fixed in pgp 0.14.2.

rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows attackers to trigger resource exhaustion vulnerabilities in rpgp by providing crafted messages. This affects general message parsing and decryption with symmetric keys.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 40% of CVEs (scores of 2026-10-31)
CWE: CWE-770
Published: 2024-12-05
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-4grw-m28r-q285	crates.io	pgp	<0.14.2	0.14.2

References

https://github.com/rpgp/rpgp/security/advisories/GHSA-4grw-m28r-q285

Check your stack JSON