Executive brief
A vulnerability in the software used to verify digital signatures on Red Hat Package Manager (RPM) files can allow an attacker to crash the system's package management tools. By providing a specially crafted RPM file, an attacker can cause the verification process to fail and immediately terminate, preventing the system from validating or processing other software packages. This results in a denial of service for package management operations, which can disrupt automated update pipelines and system maintenance.
Technical details
A vulnerability exists in rust-rpm-sequoia (librpm_sequoia) due to improper handling of OpenPGP signature parsing. A specially crafted RPM file can trigger a Rust panic during the signature verification process (e.g., via 'rpm -Kv' or 'rpm --checksig'). Because this panic crosses the Rust/C Foreign Function Interface (FFI) boundary, it results in an unconditional abort of the calling RPM process. This issue allows a local attacker to cause an application-level denial of service, preventing the system from successfully verifying RPM signatures. Red Hat has released patches for affected Enterprise Linux versions and Hardened Images.
Affected products
- Red Hat rust-rpm-sequoia All versions prior to 1.10.1.1-1.2.hum1
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux 10
- Red Hat Hardened Images
Timeline
- 2026-02-17: other: Initial report in Red Hat Bugzilla
- 2026-04-03: disclosed: CVE published
- 2026-05-01: patched: Red Hat Security Advisory RHSA-2026:12682 issued