GCVE-1-2026-0001: gnupg

Vulnerability summary

GCVE-1-2026-0001 is a vulnerability in gnupg with no CVSS score yet.

Timeline

1. 02-01-2026
   PublishedVulnerability first disclosed.
2. 02-01-2026
   Last modifiedVulnerability information updated.

Description

Reference to the gpg.fail 1.  Multiple Plaintext Attack on Detached PGP Signatures in GnuPG -  https://gpg.fail/detached 2.  GnuPG Accepts Path Separators and Path Traversals in Literal Data "Filename" Field -  https://gpg.fail/filename 3.  Cleartext Signature Plaintext Truncated for Hash Calculation -  https://gpg.fail/formfeed 4.  Encrypted message malleability checks are incorrectly enforced causing plaintext recovery attacks -  https://gpg.fail/malleability 5.  Memory Corruption in ASCII-Armor Parsing -  https://gpg.fail/memcpy 6.  Trusted comment injection (minisign) -  https://gpg.fail/minisign 7.  Cleartext Signature Forgery in the NotDashEscaped header implementation in GnuPG -  https://gpg.fail/notdash 8.  OpenPGP Cleartext Signature Framework Susceptible to Format Confusion -  https://gpg.fail/notsoclear 9.  GnuPG Output Fails To Distinguish Signature Verification Success From Message Content  https://gpg.fail/noverify 10.  Cleartext Signature Forgery in GnuPG -  https://gpg.fail/nullbyte 11.  Radix64 Line-Truncation Enabling Polyglot Attacks -  https://gpg.fail/polyglot 12.  GnuPG may downgrade digest algorithm to SHA1 during key signature checking -  https://gpg.fail/sha1 13.  GnuPG Trust Packet Parsing Enables Adding Arbitrary Subkeys -  https://gpg.fail/trust 14.  Trusted comment Injection (minisign) - https://gpg.fail/trustcomment

No weakness data has been published for this record.