CVE-2025-30258: Medium severity gnupg GnuPG vulnerability
In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/gnupg2to a version that resolves this vulnerability.Fixed in 2.2.46-6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.4.8-1 - Upgrade
Upgrade
GnuPGto a version that resolves this vulnerability.Fixed in 2.5.5
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30258?
CVE-2025-30258 is classified as a verification denial-of-service vulnerability, which can severely impact the user's ability to verify signatures.
How do I fix CVE-2025-30258?
To fix CVE-2025-30258, upgrade to GnuPG version 2.5.5 or later, which addresses this vulnerability.
What versions of GnuPG are affected by CVE-2025-30258?
GnuPG versions prior to 2.5.5 are affected by CVE-2025-30258.
What are the consequences of CVE-2025-30258?
The consequence of CVE-2025-30258 is that it can lead to a loss of the ability to verify signatures from certain signing keys.
Is there a workaround for CVE-2025-30258?
There are no known workarounds for CVE-2025-30258 other than upgrading to a non-vulnerable version.