{"answers":{"affected":"2 open source packages ship an affected version, including pgp.","exploited":"There is no known exploitation of GHSA-c7ph-f7jm-xv4w in the wild and no public exploit code.","fix":"Upgrade pgp to 0.19.0 or later.","what":"GHSA-c7ph-f7jm-xv4w is a vulnerability in pgp, published on 13 Feb 2026."},"fix_prompt":"Check this codebase for GHSA-c7ph-f7jm-xv4w and fix it if it is affected.\n\nWhat it is: GHSA-c7ph-f7jm-xv4w is a vulnerability in pgp, published on 13 Feb 2026. \nExploitation: There is no known exploitation of GHSA-c7ph-f7jm-xv4w in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- pgp (crates.io): affected from 0.16.0-alpha.0; fixed in 0.19.0\n- pgp (crates.io): affected from 0.16.0-alpha.0; fixed in 0.19.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-c7ph-f7jm-xv4w/ (Markdown: https://insights.sbomify.com/GHSA-c7ph-f7jm-xv4w/index.md)","id":"GHSA-c7ph-f7jm-xv4w","markdown":"https://insights.sbomify.com/GHSA-c7ph-f7jm-xv4w/index.md","name":"GHSA-c7ph-f7jm-xv4w","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read","security_bypass"],"network_reachable":"unknown","non_default_config":false,"product_category":"Rust PGP library","requires_auth":"none","summary":"rPGP library fails to report invalid integrity protection during decryption, potentially exposing unverified data to applications relying on it.","user_interaction":"not_required","vuln_class":"security_feature_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\nFor some messages, rPGP returned incorrectly decrypted data without signaling that integrity protection was invalid.\n\n### Details\nWhen decrypting SEIPD (Symmetrically Encrypted and Integrity Protected Data Packet), rPGP previously did not under all circumstances report the absence of valid integrity protection to callers of the library.\n\n### Impact\nWhile the resulting invalid decryption output is not attacker controlled, its contents may be a security concern if an attacker can gain access to it.\n\n### Attribution\nDiscovered internally in the course of rPGP development work.","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"rPGP's integrity protection of encrypted data was not always checked","id":"GHSA-c7ph-f7jm-xv4w","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"security_feature_bypass","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["0.19.0"],"introduced":["0.16.0-alpha.0"],"last_affected":[],"package":"pgp","purl":null,"source":"GHSA-c7ph-f7jm-xv4w"},{"ecosystem":"crates.io","fixed":["0.19.0"],"introduced":["0.16.0-alpha.0"],"last_affected":[],"package":"pgp","purl":"pkg:cargo/pgp","source":"GHSA-c7ph-f7jm-xv4w"}],"products":null,"published":"2026-02-13","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"rPGP library fails to report invalid integrity protection during decryption, potentially exposing unverified data to applications relying on it.","url":"https://insights.sbomify.com/GHSA-c7ph-f7jm-xv4w/"}