AIKIDO-2026-165900

openpgp is vulnerable to Uncontrolled Resource Consumption

Uncontrolled Resource Consumption Pre-CVE Published Jul 6, 2026

Medium Risk

This Affects:

openpgp

6.0.0 - 6.3.0

Fixed in 6.3.1

Are you affected? Scan for Free

TL;DR

The openpgp library derives symmetric keys from a passphrase using the Argon2 string-to-key function when it parses password-protected messages or private keys that select Argon2. It reads the Argon2 memory-cost exponent directly from the external-supplied packet and, before running key derivation, does not cap how much memory the derivation may request. An attacker can craft a message or key whose Argon2 parameters stay within the OpenPGP specification yet demand very large allocations, so a victim who attempts decryption triggers excessive memory allocation that can crash the process. The fix adds a config.maxArgon2MemoryExponent limit and throws Argon2OutOfMemoryError when the requested exponent exceeds it.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and decrypt password-protected messages or keys that use Argon2 for string-to-key derivation.