Critical Security Flaw in RPM Sequoia: Key Flag Confusion Vulnerability
Summary
ALSA-2026:76733: Important: rust-rpm-sequoia security update. Affects rpm-sequoia versions < 1.10.2.1-1.el9_8. Fixed in 1.10.2.1-1.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
RPM Sequoia is an implementation of the RPM PGP interface utilizing Sequoia, designed to handle package management in Linux distributions. It ensures the integrity and authenticity of software packages through cryptographic signatures. However, it has been found vulnerable to a key flag confusion issue that compromises cryptographic integrity, potentially allowing unauthorized access or manipulation of package data.
Vulnerability Detail
The vulnerability, identified as CVE-2026-42784, arises from a confusion in key flags within the sequoia-openpgp library. This flaw can lead to a compromise of cryptographic integrity, allowing attackers to exploit the system by manipulating package signatures. The ramifications include unauthorized access to sensitive data, installation of malicious packages, and overall system compromise. The issue is particularly critical as it undermines the trust model of package management systems, which rely on cryptographic verification.
How To Fix
Minimum fixed version
1.10.2.1-1.el9_8
This is the first release that contains the fix.
sudo dnf update rpm-sequoiaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected functionalities of the RPM Sequoia package until the update is applied. However, this is not a long-term solution and updating the package is strongly recommended.
Conclusion
The RPM Sequoia package has a critical vulnerability (CVE-2026-42784) that compromises cryptographic integrity due to key flag confusion. Users are urged to update their packages to the latest patched version to mitigate risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for rpm-sequoia →
FAQ
CVE-2026-42784 is a security vulnerability in the RPM Sequoia package that allows for cryptographic integrity compromise due to key flag confusion.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to unauthorized access, installation of malicious packages, and overall compromise of the system's integrity.
Yes, a patch is available. Users should update to version 1.10.2.1-1.el9_8 or later of the affected packages.
If immediate updating is not possible, refrain from using the affected functionalities as a temporary workaround until the update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for rpm-sequoia.
