- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 5 · 4 high, 1 medium
Advisories 5
- CVE-2026-12817High 8.7
OpenPGP AEAD decryption skips final tag on chunk-aligned data
Affected: from 1.74, fixed in 1.85.
- CVE-2026-59640High 8.7
OpenPGP CFB quick-check oracle active on symmetric/session-key paths
Affected: fixed in 1.85.
- CVE-2026-59643High 8.7
OpenPGP inline-signature policy failures silently ignored
Affected: from 1.81, fixed in 1.85.
- CVE-2026-59648Medium 6.9
OpenPGP Argon2 S2K honours attacker-chosen memory and passes
Affected: from 1.71, fixed in 1.85.
- CVE-2026-59649High 8.7
OpenPGP user-attribute subpacket length bounded only by JVM max memory
Affected: fixed in 1.85.