Verification Denial of Service Vulnerability in GnuPG from GnuPG Development

CVE-2025-30258

What is CVE-2025-30258?

In earlier versions of GnuPG, prior to 2.5.5, a vulnerability was identified whereby importing a specially crafted certificate containing malformed subkey data could lead to a denial of service in signature verification. This occurs when the certificate lacks a valid backsignature or has incorrect usage flags, resulting in users being unable to verify signatures from certain signing keys. This issue can significantly hinder the functionality of cryptographic operations reliant on GnuPG.

References