What is GHSA-m6x2-4hhh-669j?

GHSA-m6x2-4hhh-669j is a security advisory published by GitHub Security Advisories with Low severity. CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS...

Which CVE IDs does GHSA-m6x2-4hhh-669j cover?

GHSA-m6x2-4hhh-669j covers the following CVE IDs: CVE-2026-57062. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-m6x2-4hhh-669j?

GHSA-m6x2-4hhh-669j has a CVSS v3 base score of 2.9, published by GitHub Security Advisories.

GHSA-m6x2-4hhh-669jLowCVSS 2.9

CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS...

Vendor

GitHub Security Advisories

Published

June 23, 2026

Last Modified

June 23, 2026

🔗 CVE IDs covered (1)

CVE-2026-57062 →

📋 Description

CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-57062
https://blog.calif.io/p/how-to-format-a-ciphertext
https://www.gnupg.org/download
https://github.com/advisories/GHSA-m6x2-4hhh-669j