CVE-2026-42784 in Sequoia Openpgp
Summary
by MITRE • 09/16/2026
A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.