Critical Security Update for libgcrypt: CVE-2026-41989
Summary
RHSA-2026:58978: Red Hat Security Advisory: libgcrypt security update. Affects libgcrypt versions < 0:1.8.5-7.el8_6.1. Fixed in 0:1.8.5-7.el8_6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libgcrypt is a cryptographic library that provides a wide range of cryptographic functions, including symmetric and asymmetric encryption, hashing, and random number generation. It is widely used in various applications to ensure data security and integrity. The library is essential for applications that require secure communication and data protection. However, vulnerabilities in libgcrypt can lead to severe security risks, including unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability identified as CVE-2026-41989 affects libgcrypt versions prior to 1.8.5-7.el8_6.1. This issue arises from improper handling of cryptographic operations, which could allow an attacker to exploit the library and potentially gain unauthorized access to sensitive data or disrupt cryptographic processes. The ramifications of this vulnerability are significant, as it can compromise the security of applications relying on libgcrypt for encryption and data integrity.
How To Fix
Minimum fixed version
0:1.8.5-7.el8_6.1
This is the first release that contains the fix.
sudo dnf update libgcryptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if an immediate update is not feasible, consider limiting the use of libgcrypt in sensitive applications until the patch can be applied. Additionally, review application logs for any unusual activities that may indicate exploitation attempts.
Conclusion
The vulnerability CVE-2026-41989 in libgcrypt poses a significant security risk that can lead to unauthorized access to sensitive data. It is crucial to update to the patched version 1.8.5-7.el8_6.1 to mitigate this risk. Users are encouraged to monitor their applications for any signs of exploitation and utilize tools like Vulert for real-time vulnerability alerts.
See every vulnerability recorded for libgcrypt →
FAQ
CVE-2026-41989 is a security vulnerability in the libgcrypt library that can lead to unauthorized access to sensitive data.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can compromise the security of applications using libgcrypt, leading to unauthorized data access and potential data breaches.
Yes, the patched version of libgcrypt is 1.8.5-7.el8_6.1, which addresses the vulnerability.
The CVSS score for CVE-2026-41989 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for libgcrypt.
