Critical Security Update for libgcrypt: CVE-2026-41989
Summary
RHSA-2026:58977: Red Hat Security Advisory: libgcrypt security update. Affects libgcrypt versions < 0:1.8.5-7.el8_8.1. Fixed in 0:1.8.5-7.el8_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libgcrypt is a cryptographic library that provides a wide range of cryptographic functions, including symmetric and asymmetric encryption, hashing, and random number generation. It is widely used in various applications to ensure data integrity and confidentiality. The library is essential for secure communications and data protection, making its security paramount. The vulnerability in question could potentially compromise the integrity of cryptographic operations, leading to severe security risks.
Vulnerability Detail
The vulnerability identified as CVE-2026-41989 affects libgcrypt due to improper handling of certain cryptographic operations. This flaw can be exploited by attackers to manipulate cryptographic processes, potentially allowing unauthorized access to sensitive data or the ability to forge cryptographic signatures. The vulnerability has a CVSS score of 7.5, indicating a high severity level. If exploited, it could lead to significant ramifications for applications relying on libgcrypt for security.
How To Fix
Minimum fixed version
0:1.8.5-7.el8_8.1
This is the first release that contains the fix.
sudo dnf update libgcryptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the use of libgcrypt in applications that require high security until the package is updated. However, it is strongly recommended to apply the patch as soon as possible to mitigate risks.
Conclusion
The libgcrypt library has a critical vulnerability (CVE-2026-41989) that poses significant risks to applications relying on its cryptographic functions. It is crucial to update to the latest patched version to ensure security and integrity. Users are encouraged to utilize tools like Vulert to monitor for vulnerabilities in their software.
See every vulnerability recorded for libgcrypt →
FAQ
CVE-2026-41989 is a security vulnerability in the libgcrypt library that can lead to unauthorized access and manipulation of cryptographic operations.
If your application relies on libgcrypt for cryptographic functions, it may be at risk of data breaches or unauthorized actions due to this vulnerability.
You should immediately update libgcrypt to the patched version 0:1.8.5-7.el8_8.1 or later to protect your application from potential exploits.
Yes, you can use Vulert, which allows you to monitor and alert in real-time for open-source vulnerabilities. You can check your application using the Vulert playground without any signup.
The CVSS score of CVE-2026-41989 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for libgcrypt.
