CVE-2024-58261: Low severity (DoS) vulnerability in sequoia-openpgp

June 26, 2024 (updated July 28, 2025)

There is a denial-of-service vulnerability in sequoia-openpgp, our crate providing a low-level interface to our OpenPGP implementation. When triggered, the process will enter an infinite loop.

Many thanks to Andrew Gallagher for disclosing the issue to us.

References

github.com/advisories/GHSA-9344-p847-qm5c
gitlab.com/sequoia-pgp/sequoia
gitlab.com/sequoia-pgp/sequoia/-/issues/1106
nvd.nist.gov/vuln/detail/CVE-2024-58261
rustsec.org/advisories/RUSTSEC-2024-0345.html

Code Behaviors & Features

Detect and mitigate CVE-2024-58261 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →