2.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-rfx3-ffrp-6875

GHSA-rfx3-ffrp-6875: Duplicate Advisory: sequoia-openpgp vulnerable to out-of-bounds array access leading to panic

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-25mx-8f3v-8wh7. This link is maintained to preserve external references.

Original Description

The sequoia-openpgp crate before 1.16.0 for Rust allows out-of-bounds array access and a panic.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-rfx3-ffrp-6875

GHSA-rfx3-ffrp-6875:

2.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
sequoia-openpgp	rust	< 1.1.1	1.1.1
sequoia-openpgp	rust	>= 1.2.0, < 1.8.1	1.8.1
sequoia-openpgp	rust	>= 1.9.0, < 1.16.0	1.16.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is caused by a series of missing bounds checks in the parsing logic of the sequoia-openpgp crate. An attacker can craft malicious OpenPGP packets that, when parsed, cause out-of-bounds array access. In Rust, this leads to a panic, which can be used to cause a denial of service in applications using this library.

The fixes were applied in several releases (1.1.1, 1.8.1, 1.16.0), each addressing different parser vulnerabilities. The patches consistently show a pattern of replacing direct array indexing and unsafe slicing with safe alternatives like get() and explicit length checks.

The vulnerable functions are primarily from_bytes or new methods on various packet types, which are responsible for deserializing the packet data. These functions are the entry points for the malicious input to trigger the vulnerability. Any application that parses untrusted OpenPGP data is susceptible to this denial-of-service attack.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.