CVE-2026-2625 Rust-rpm-sequoia: rust-rpm-sequoia: denial of service via crafted rpm file during signature verification
An attacker can cause a denial of service by providing a crafted RPM file that crashes the signature verification process in rust-rpm-sequoia.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-2625?
CVE-2026-2625 is a medium-severity denial of service vulnerability in Redhat Enterprise Linux, published on 3 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager (RPM) file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an unconditional termination of the rpm process. This issue results in an application level denial of service, making the system unable to process RPM files for signature verification.
Weakness: CWE-347
Which versions are affected by CVE-2026-2625?
It affects 3 products.
Linux distribution packages (3)
rpm-sequoia Red Hat:hummingbird:1 | All versions | 0:1.10.1.1-1.2.hum1 |
rpm-sequoia-devel Red Hat:hummingbird:1 | All versions | 0:1.10.1.1-1.2.hum1 |
rust-rpm-sequoia Red Hat:hummingbird:1 | All versions | 0:1.10.1.1-1.2.hum1 |
Products include Redhat Enterprise Linux, Redhat Hardened Images, Sequoia-Pgp Rpm-Sequoia.
How do I fix CVE-2026-2625?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-2625 being exploited?
There is no known exploitation of CVE-2026-2625 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux
- CVE-2018-14667 Red Hat JBoss RichFaces Framework Expression Language Injection
- CVE-2021-20325 Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a securit
- CVE-2018-25011 Memory corruption in libwebp
- CVE-2018-25014 Other in libwebp
- CVE-2014-3585 Supply chain in redhat-upgrade-tool
Sources
Also known as DEBIAN-CVE-2026-2625, ECHO-2654-d857-4161, GHSA-p6j6-g4fc-g496, RHSA-2026:12682, UBUNTU-CVE-2026-2625.