{"action":"Upgrade sequoia-openpgp to 2.1.0 or later.","affected":[{"fixed":"2.1.0","introduced":"0"}],"component":"sequoia-openpgp","cve_ids":["CVE-2025-67897"],"ecosystem":"crates.io","epss":0.00354,"exploited":false,"fixed_versions":["2.1.0"],"ghsa_id":"GHSA-v6x3-9r38-r27q","id":"tcs_01M5KF3DDQ9RBFYHV4E8W0695B","modified_at":"2026-09-10T03:50:32.193634287Z","published_at":"2025-12-14T06:30:24Z","references":["https://osv.dev/vulnerability/GHSA-v6x3-9r38-r27q","https://nvd.nist.gov/vuln/detail/CVE-2025-67897","https://bugs.debian.org/1122582","https://gitlab.com/sequoia-pgp/sequoia","https://gitlab.com/sequoia-pgp/sequoia/-/blob/b59886e5e7bdf7169ed330f309a6633d131776e5/openpgp/NEWS#L7-L26","https://gitlab.com/sequoia-pgp/sequoia/-/commit/b59886e5e7bdf7169ed330f309a6633d131776e5","https://rustsec.org/advisories/RUSTSEC-2025-0136.html"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-v6x3-9r38-r27q","url":"https://osv.dev/vulnerability/GHSA-v6x3-9r38-r27q"}],"summary":"Sequoia PGP has Subtraction Overflow when aes_key_unwrap function is provided ciphertext that is too short"}