High severity7.4NVD Advisory· Published Sep 16, 2026· Updated Oct 9, 2026
CVE-2026-42784
CVE-2026-42784
Description
A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
6- osv-coords4 versionspkg:rpm/almalinux/rpm-sequoiapkg:rpm/almalinux/rpm-sequoia-develpkg:rpm/almalinux/sequoia-sqpkg:rpm/almalinux/sequoia-sqv
< 1.10.2.1-1.el9_8+ 3 more
- (no CPE)range: < 1.10.2.1-1.el9_8
- (no CPE)range: < 1.10.2.1-1.el9_8
- (no CPE)range: < 1.4.0.1-2.el10_2
- (no CPE)range: < 1.3.0.2-1.el10_2
Patches
Vulnerability mechanics
References
10- access.redhat.com/errata/RHSA-2026:34160nvd
- access.redhat.com/errata/RHSA-2026:42078nvd
- access.redhat.com/errata/RHSA-2026:42902nvd
- access.redhat.com/errata/RHSA-2026:76733nvd
- access.redhat.com/errata/RHSA-2026:76734nvd
- access.redhat.com/errata/RHSA-2026:76735nvd
- access.redhat.com/errata/RHSA-2026:76737nvd
- access.redhat.com/errata/RHSA-2026:79357nvd
- access.redhat.com/security/cve/CVE-2026-42784nvd
- bugzilla.redhat.com/show_bug.cginvd
News mentions
0No linked articles in our index yet.