Status: UPDATED
| Advisory ID: CVE-2026-42784
Key Details
| CVE | CVE-2026-42784 |
| CVSS Score / Version | 7.4 (High) / CVSS v3.1 |
| Updated | 2026-09-23 |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N |
| CVSS Prose | attack vector is network; attack complexity is low; privileges required is none; user interaction is required; scope is changed; confidentiality impact is none; integrity impact is high; availability impact is none. |
| Affected products | see table below |
| Classified as | CWE-347 (Improper Verification of Cryptographic Signature) |
Affected Products, Subsystems & Sectors
| Subsystems | General OT |
| Sectors | Multiple |
What to Know
A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity. (NVD)
What to Do
Monitor Red Hat's web page for any future patch releases.
References