CVE-2024-53856: rpgp Denial-of-Service Vulnerability Due to Malformed Input
Summary
CVE-2024-53856: rPGP Panics on Malformed Untrusted Input. Affects pgp versions < 0.14.1. Fixed in 0.14.1. How to fix ↓
Also tracked for
- rust-pgp · Debian:13
The same CVE-2024-53856 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rpgp package is a Rust library designed for handling OpenPGP messages, providing functionalities such as encryption, decryption, and key management. It is widely used in applications that require secure communication and data integrity. However, the library is vulnerable to specific malformed inputs that can cause it to crash, leading to potential denial-of-service scenarios.
Vulnerability Detail
During a security audit conducted by Radically Open Security, several edge cases were identified where the rpgp library could panic and crash when processing malformed OpenPGP messages. This vulnerability can be exploited by remote attackers, as the malformed messages do not require any victim-specific knowledge. The scenarios include parsing OpenPGP messages, decrypting messages, and handling public/private keys. The result is a denial-of-service impact, halting the program without affecting confidentiality or integrity.
How To Fix
Latest published version: 0.21.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.14.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds to mitigate this vulnerability without upgrading the package. It is strongly recommended to apply the patch as soon as possible.
Conclusion
The rpgp library is vulnerable to denial-of-service attacks due to its inability to handle malformed OpenPGP messages properly. Users are strongly encouraged to upgrade to version 0.14.1 to mitigate this risk. Monitoring tools like Vulert can help identify vulnerabilities in your applications without requiring code access.
See every vulnerability recorded for pgp →
FAQ
CVE-2024-53856 is a vulnerability in the rpgp library that allows attackers to crash the application by sending malformed OpenPGP messages.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
The primary consequence is a denial-of-service attack, where the application crashes and becomes unavailable, but there is no impact on data confidentiality or integrity.
Yes, the vulnerability has been fixed in version 0.14.1 of the rpgp package. Users should upgrade to this version to mitigate the issue.
While there are no specific workarounds, it is crucial to prioritize upgrading to the patched version to ensure the security of your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for pgp.
