N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-8h58-w33p-wq3g

GHSA-8h58-w33p-wq3g: rPGP affected by crash in message handling for deeply nested messages

Summary

Previous rPGP versions could be caused to crash with a "stack overflow" when parsing messages that contain deeply nested message layers, such as messages with many signatures.

rPGP 0.19.0 resolves this issue with a more robust message handling implementation (via https://github.com/rpgp/rpgp/pull/625).

Impact

An attacker could cause applications to crash in rPGP's message parsing subsystem, when applications attempt to ingest messages.

Attribution

Discovered internally during rPGP development, using a fuzz test suite previously contributed by Christian Reitter.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-8h58-w33p-wq3g

GHSA-8h58-w33p-wq3g:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pgp	rust	>= 0.16.0-alpha.0, < 0.19.0	0.19.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stack overflow caused by unbounded recursion when parsing deeply nested OpenPGP messages. The analysis of the patch commit e82f2c7494ba277d62fd372d69b2c008473bbef8 clearly shows the root cause. The file src/composed/message/parser.rs contained a recursive function next which would call itself upon encountering a signature packet (Tag::Signature or Tag::OnePassSignature). This design is inherently vulnerable to stack exhaustion if a message contains a sufficiently large number of nested signatures.

The patch addresses this by completely refactoring the parser. The recursive next function is removed and replaced with an iterative approach implemented in a new MessageParser struct. This new parser uses a loop and a state machine to process message packets, collecting signature information in a vector (Vec<SignaturePacket>) instead of creating a deeply nested call stack. This change effectively mitigates the stack overflow vulnerability.

Further evidence is found in the test files. The patch adds new tests (message_many_one_pass_signatures, message_many_prefix_signatures) in tests/message_test.rs that specifically create and parse messages with 2000 signatures to ensure the new iterative implementation can handle them without crashing. This confirms that the recursive parsing was the issue and the iterative approach is the fix. The vulnerable function is therefore identified as pgp::composed::message::parser::next.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.