CVE-2025-0509: Sparkle Signing Checks Bypass

February 4, 2025

A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA signing checks.

References

github.com/advisories/GHSA-wc9m-r3v6-9p5h
github.com/sparkle-project/Sparkle
github.com/sparkle-project/Sparkle/pull/2550
nvd.nist.gov/vuln/detail/CVE-2025-0509
security.netapp.com/advisory/ntap-20250124-0008
sparkle-project.org/documentation/security-and-reliability

Detect and mitigate CVE-2025-0509 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →