Security Update: libgcrypt Vulnerability Leading to Denial of Service and Buffer Overflow
Summary
ALSA-2026:47117: Moderate: libgcrypt security update. Affects libgcrypt versions < 1.8.5-8.el8_10. Fixed in 1.8.5-8.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libgcrypt is a general-purpose cryptographic library that provides implementations of various cryptographic algorithms. It is widely used in many applications for secure data processing and encryption. The library is essential for maintaining the confidentiality and integrity of sensitive information. However, vulnerabilities in libgcrypt can expose applications to significant security risks, including denial of service and data breaches.
Vulnerability Detail
The vulnerability identified as CVE-2026-41989 in libgcrypt allows for a denial of service and buffer overflow through crafted ECDH ciphertext. This issue arises from improper handling of specific input data, which can lead to application crashes or unexpected behavior. Attackers can exploit this vulnerability to disrupt services or potentially execute arbitrary code, posing a severe risk to systems relying on the library for cryptographic operations.
How To Fix
Minimum fixed version
1.8.5-8.el8_10
This is the first release that contains the fix.
sudo dnf update libgcryptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. The best course of action is to apply the available security updates as soon as possible.
Conclusion
The libgcrypt vulnerability CVE-2026-41989 poses significant risks, including denial of service and buffer overflow. It is crucial for users of the library to update to the patched version to protect their applications from potential exploitation. Regular monitoring and updates are essential for maintaining security.
See every vulnerability recorded for libgcrypt →
FAQ
CVE-2026-41989 is a vulnerability in the libgcrypt library that can lead to denial of service and buffer overflow through crafted ECDH ciphertext.
If your application uses libgcrypt, it may be susceptible to crashes or unexpected behavior, potentially allowing attackers to disrupt services or execute arbitrary code.
You should update the libgcrypt and libgcrypt-devel packages to the patched version 1.8.5-8.el8_10 to mitigate the risks associated with this vulnerability.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software by analyzing a manifest file like package-lock.json. It helps developers ensure their applications are secure.
Related vulnerabilities
Recent vulnerabilities recorded for libgcrypt.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
