Vulnerability-Lookup

GCVE-1-2026-0001

Vulnerability from gna-1 – Published: 2026-01-02 10:20 – Updated: 2026-01-02 13:31

Title

Bundle reference to gpg.fail

Summary

Reference to the gpg.fail 1. Multiple Plaintext Attack on Detached PGP Signatures in GnuPG - https://gpg.fail/detached 2. GnuPG Accepts Path Separators and Path Traversals in Literal Data "Filename" Field - https://gpg.fail/filename 3. Cleartext Signature Plaintext Truncated for Hash Calculation - https://gpg.fail/formfeed 4. Encrypted message malleability checks are incorrectly enforced causing plaintext recovery attacks - https://gpg.fail/malleability 5. Memory Corruption in ASCII-Armor Parsing - https://gpg.fail/memcpy 6. Trusted comment injection (minisign) - https://gpg.fail/minisign 7. Cleartext Signature Forgery in the NotDashEscaped header implementation in GnuPG - https://gpg.fail/notdash 8. OpenPGP Cleartext Signature Framework Susceptible to Format Confusion - https://gpg.fail/notsoclear 9. GnuPG Output Fails To Distinguish Signature Verification Success From Message Content https://gpg.fail/noverify 10. Cleartext Signature Forgery in GnuPG - https://gpg.fail/nullbyte 11. Radix64 Line-Truncation Enabling Polyglot Attacks - https://gpg.fail/polyglot 12. GnuPG may downgrade digest algorithm to SHA1 during key signature checking - https://gpg.fail/sha1 13. GnuPG Trust Packet Parsing Enables Adding Arbitrary Subkeys - https://gpg.fail/trust 14. Trusted comment Injection (minisign) - https://gpg.fail/trustcomment

Severity

No CVSS data available.

CWE

Assigner

GNA-1 This instance

References

1 reference

URL	Tags
https://gpg.fail/

Impacted products

1 product

Vendor	Product	Version	CPE status
gnupg	gnupg	Affected:	guessed

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "gnupg",
          "vendor": "gnupg",
          "versions": [
            {
              "status": "affected"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eReference to the\u0026nbsp;gpg.fail\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e1.\u0026nbsp; Multiple Plaintext Attack on Detached PGP Signatures in GnuPG -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/detached\"\u003ehttps://gpg.fail/detached\u003c/a\u003e\u003cbr\u003e2.\u0026nbsp; GnuPG Accepts Path Separators and Path Traversals in Literal Data \"Filename\" Field -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/filename\"\u003ehttps://gpg.fail/filename\u003c/a\u003e\u003cbr\u003e3.\u0026nbsp; Cleartext Signature Plaintext Truncated for Hash Calculation -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/formfeed\"\u003ehttps://gpg.fail/formfeed\u003c/a\u003e\u003cbr\u003e4.\u0026nbsp; Encrypted message malleability checks are incorrectly enforced causing plaintext recovery attacks -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/malleability\"\u003ehttps://gpg.fail/malleability\u003c/a\u003e\u003cbr\u003e5.\u0026nbsp; Memory Corruption in ASCII-Armor Parsing -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/memcpy\"\u003ehttps://gpg.fail/memcpy\u003c/a\u003e\u003cbr\u003e6.\u0026nbsp; Trusted comment injection (minisign) -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/minisign\"\u003ehttps://gpg.fail/minisign\u003c/a\u003e\u003cbr\u003e7.\u0026nbsp; Cleartext Signature Forgery in the NotDashEscaped header implementation in GnuPG -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/notdash\"\u003ehttps://gpg.fail/notdash\u003c/a\u003e\u003cbr\u003e8.\u0026nbsp; OpenPGP Cleartext Signature Framework Susceptible to Format Confusion -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/notsoclear\"\u003ehttps://gpg.fail/notsoclear\u003c/a\u003e\u003cbr\u003e9.\u0026nbsp; GnuPG Output Fails To Distinguish Signature Verification Success From Message Content\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/noverify\"\u003ehttps://gpg.fail/noverify\u003c/a\u003e\u003cbr\u003e10.\u0026nbsp; Cleartext Signature Forgery in GnuPG -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/nullbyte\"\u003ehttps://gpg.fail/nullbyte\u003c/a\u003e\u003cbr\u003e11.\u0026nbsp; Radix64 Line-Truncation Enabling Polyglot Attacks -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/polyglot\"\u003ehttps://gpg.fail/polyglot\u003c/a\u003e\u003cbr\u003e12.\u0026nbsp; GnuPG may downgrade digest algorithm to SHA1 during key signature checking -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/sha1\"\u003ehttps://gpg.fail/sha1\u003c/a\u003e\u003cbr\u003e13.\u0026nbsp; GnuPG Trust Packet Parsing Enables Adding Arbitrary Subkeys -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/trust\"\u003ehttps://gpg.fail/trust\u003c/a\u003e\u003cbr\u003e14.\u0026nbsp; Trusted comment Injection (minisign) - \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/trustcomment\"\u003ehttps://gpg.fail/trustcomment\u003c/a\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e"
            }
          ],
          "value": "Reference to the\u00a0gpg.fail\n\n\n\n\n1.\u00a0 Multiple Plaintext Attack on Detached PGP Signatures in GnuPG -\u00a0 https://gpg.fail/detached \n2.\u00a0 GnuPG Accepts Path Separators and Path Traversals in Literal Data \"Filename\" Field -\u00a0 https://gpg.fail/filename \n3.\u00a0 Cleartext Signature Plaintext Truncated for Hash Calculation -\u00a0 https://gpg.fail/formfeed \n4.\u00a0 Encrypted message malleability checks are incorrectly enforced causing plaintext recovery attacks -\u00a0 https://gpg.fail/malleability \n5.\u00a0 Memory Corruption in ASCII-Armor Parsing -\u00a0 https://gpg.fail/memcpy \n6.\u00a0 Trusted comment injection (minisign) -\u00a0 https://gpg.fail/minisign \n7.\u00a0 Cleartext Signature Forgery in the NotDashEscaped header implementation in GnuPG -\u00a0 https://gpg.fail/notdash \n8.\u00a0 OpenPGP Cleartext Signature Framework Susceptible to Format Confusion -\u00a0 https://gpg.fail/notsoclear \n9.\u00a0 GnuPG Output Fails To Distinguish Signature Verification Success From Message Content\u00a0 https://gpg.fail/noverify \n10.\u00a0 Cleartext Signature Forgery in GnuPG -\u00a0 https://gpg.fail/nullbyte \n11.\u00a0 Radix64 Line-Truncation Enabling Polyglot Attacks -\u00a0 https://gpg.fail/polyglot \n12.\u00a0 GnuPG may downgrade digest algorithm to SHA1 during key signature checking -\u00a0 https://gpg.fail/sha1 \n13.\u00a0 GnuPG Trust Packet Parsing Enables Adding Arbitrary Subkeys -\u00a0 https://gpg.fail/trust \n14.\u00a0 Trusted comment Injection (minisign) -  https://gpg.fail/trustcomment"
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "url": "https://gpg.fail/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Bundle reference to gpg.fail",
      "x_gcve": [
        {
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-0001"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "datePublished": "2026-01-02T10:20:00.000Z",
    "dateUpdated": "2026-01-02T13:31:14.359346Z",
    "requesterUserId": "00000000-0000-4000-9000-000000000000",
    "serial": 1,
    "state": "PUBLISHED",
    "vulnId": "gcve-1-2026-0001",
    "vulnerabilitylookup_history": [
      [
        "alexandre.dulaunoy@circl.lu",
        "2026-01-02T10:20:24.357623Z"
      ],
      [
        "alexandre.dulaunoy@circl.lu",
        "2026-01-02T10:20:45.873825Z"
      ],
      [
        "alexandre.dulaunoy@circl.lu",
        "2026-01-02T13:28:12.107109Z"
      ],
      [
        "alexandre.dulaunoy@circl.lu",
        "2026-01-02T13:31:14.359346Z"
      ]
    ]
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GCVE-1-2026-0001

Tags

Sightings

Nomenclature

Related by attack behaviour