CVE-2025-30258 Denial of service in GnuPG
Attackers can cause a verification denial of service in GnuPG by importing crafted certificates, preventing users from verifying signatures from other keys.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-30258?
CVE-2025-30258 is a low-severity denial of service vulnerability in GnuPG, published on 19 Mar 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS."
Weakness: CWE-754
Which versions are affected by CVE-2025-30258?
It affects 1 product.
Linux distribution packages (15)
gpg2 SUSE:Linux Enterprise Micro 5.2 | All versions | 2.2.27-150300.3.13.1 |
gpg2 SUSE:Linux Enterprise Micro 5.3 | All versions | 2.2.27-150300.3.13.1 |
gpg2 SUSE:Linux Enterprise Micro 5.4 | All versions | 2.2.27-150300.3.13.1 |
gpg2 SUSE:Linux Enterprise Micro 5.5 | All versions | 2.2.27-150300.3.13.1 |
gpg2 SUSE:Linux Enterprise Module for Basesystem 15 SP6 | All versions | 2.4.4-150600.3.9.1 |
gpg2 SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 2.4.4-150600.3.9.1 |
gpg2 SUSE:Linux Micro 6.0 | All versions | 2.4.4-2.1 |
gpg2 SUSE:Linux Micro 6.0 | All versions | 2.4.4-4.1 |
gpg2 SUSE:Linux Micro 6.0 | All versions | 2.4.4-5.1 |
gpg2 SUSE:Linux Micro 6.1 | All versions | 2.4.4-slfo.1.1_2.1 |
gpg2 SUSE:Linux Micro 6.1 | All versions | 2.4.4-slfo.1.1_3.1 |
gpg2 SUSE:Linux Micro 6.1 | All versions | 2.4.4-slfo.1.1_4.1 |
gpg2 SUSE:Linux Micro 6.1 | All versions | 2.4.4-slfo.1.1_5.1 |
gpg2 openSUSE:Leap 15.6 | All versions | 2.4.4-150600.3.9.1 |
gpg2 openSUSE:Tumbleweed | All versions | 2.5.6-1.1 |
Products include Gnupg Gnupg.
How do I fix CVE-2025-30258?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-30258 being exploited?
There is no known exploitation of CVE-2025-30258 in the wild and no public exploit code.
Other vulnerabilities in GnuPG
Sources
Also known as AZL-58932, AZL-58935, CLSA-2026-1774612633, CLSA-2026-1775119189, CLSA-2026-1776159098, DEBIAN-CVE-2025-30258 and 24 more.