CVE-2022-3219 Denial of service in gnupg
Attackers can cause GnuPG to consume excessive CPU resources by providing a crafted public key with many compressed signatures, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-3219?
CVE-2022-3219 is a low-severity denial of service vulnerability in gnupg, published on 23 Feb 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.
Weakness: CWE-787
Which versions are affected by CVE-2022-3219?
It affects 1 product.
Products include Gnupg Gnupg.
How do I fix CVE-2022-3219?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-3219 being exploited?
There is no known exploitation of CVE-2022-3219 in the wild and no public exploit code.
Other vulnerabilities in gnupg
Sources
Also known as CLEANSTART-2026-CL42634, CLSA-2026-1780512159, DEBIAN-CVE-2022-3219, ECHO-7c72-1439-373e, GHSA-pf7g-97vv-qmrr, MINI-25fw-j3qq-7cmf and 2 more.