CVE-2024-53857CWE-770

rPGP Potential Resource Exhaustion when handling Untrusted Messages

High · published December 5, 2024

CVSS v3.1
7.5
EPSS
0%
Percentile
39.4
In the wild
Unconfirmed
What it is

rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows attackers to trigger resource exhaustion vulnerabilities in rpgp by providing crafted messages. This affects general message parsing and decryption with symmetric keys.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00467 · 39.4th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2024-12-05T15:22Z
EPSS history
Timeline
  • 05 DEC 15:22Z
    rPGP Potential Resource Exhaustion when handling Untrusted Messages
    cvelistv5