Title: Red Hat, Description: Se encontró una falla en rust-rpm-sequoia. Un atacante puede explotar esta vulnerabilidad al proporcionar un archivo de Red Hat Package Manager (RPM) especialmente diseñado. Durante el proceso de verificación de firmas de RPM, este archivo diseñado puede desencadenar un error en el código de análisis de firmas OpenPGP, lo que lleva a una terminación incondicional del proceso rpm. Este problema resulta en una denegación de servicio a nivel de aplicación, haciendo que el sistema sea incapaz de procesar archivos RPM para la verificación de firmas.

{"timestamp":"2026-04-08T18:51:58.247478Z","id":"CVE-2026-2625","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Red Hat","product":"Red Hat Hardened Images","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"rust-rpm-sequoia-main","cpes":["cpe:/a:redhat:hummingbird:1"],"versions":[{"version":"1.10.1.1-1.2.hum1","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rust-rpm-sequoia","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rust-rpm-sequoia","cpes":["cpe:/o:redhat:enterprise_linux:9"]}]

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

OR
          *cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
          *cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
          *cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:*
          *cpe:2.3:a:sequoia-pgp:rpm-sequoia:-:*:*:*:*:rust:*:*

Red Hat, Inc.: https://access.redhat.com/errata/RHSA-2026:12682 Types: Third Party Advisory

Red Hat, Inc.: https://access.redhat.com/security/cve/CVE-2026-2625 Types: Mitigation, Third Party Advisory

Red Hat, Inc.: https://bugzilla.redhat.com/show_bug.cgi?id=2440357 Types: Issue Tracking, Third Party Advisory

https://access.redhat.com/errata/RHSA-2026:12682

A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager (RPM) file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an unconditional termination of the rpm process. This issue results in an application level denial of service, making the system unable to process RPM files for signature verification.

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-347

https://access.redhat.com/security/cve/CVE-2026-2625

https://bugzilla.redhat.com/show_bug.cgi?id=2440357