GHSA-c7ph-f7jm-xv4w: rPGP's integrity protection of encrypted data was not always checked

February 13, 2026

For some messages, rPGP returned incorrectly decrypted data without signaling that integrity protection was invalid.

References

github.com/advisories/GHSA-c7ph-f7jm-xv4w
github.com/rpgp/rpgp
github.com/rpgp/rpgp/security/advisories/GHSA-c7ph-f7jm-xv4w

Code Behaviors & Features

Detect and mitigate GHSA-c7ph-f7jm-xv4w with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →