- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 12
- Public CVEs
- 55
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
12 assets you may test, 5 excluded.
Web 1
- https://gnupg.org/software/libgcrypt
Products and areas 11
- Key derivation and password-based key derivation, including the parameter handling that decides the real cost of a crack
- The GnuPG security page asks for severe security problems by private mail and publishes an explicit threat model for libgcrypt. Beyond the side channel carve-out in that model, it draws no boundary narrower than the library itself
- The hand-written assembly selected per CPU feature, along with the portable C fallback that runs where no accelerated path exists
- The hash and MAC families, covering the SHA and BLAKE algorithms and the HMAC and CMAC constructions built on them
- The multi-precision integer layer, which is the arithmetic every asymmetric operation runs through and the place a carry or reduction defect becomes a key recovery
- The public key implementations: RSA, DSA, the elliptic curve algorithms, and the key generation and parameter checking around each
- The random number generator, its entropy gathering, its reseeding and its behaviour in the early boot and container cases where entropy is scarce
- The secure memory subsystem, covering locked pages, the allocator and the wiping guarantees the library advertises
- The self-test and FIPS mode machinery, where a test that passes over a broken implementation is itself the defect
- The S-expression parser and the public API surface, which handles structured input supplied by the calling application
- The symmetric ciphers and their modes, including the AEAD constructions and their tag verification paths
Out of scope (5)
- Caller misuse of the API where the documented contract was broken
- Cross-VM and hardware-level side channels, which the published threat model places outside the library's boundary
- Defects in GnuPG, GnuTLS or systemd rather than in libgcrypt, even where libgcrypt is on the call path
- Distribution patches and packaging choices rather than upstream libgcrypt
- Weaknesses in a standardised algorithm rather than in this implementation of it
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz.
-
Report by email to the security address published on the GnuPG security page
-
Send plain text.
-
Name the version and the build.
-
Say which consumer reaches the defect.
-
Hold the detail until the announcement and the distribution updates are out.
Not accepted
-
Cross-VM and hardware-level side channels
-
Defects in GnuPG, GnuTLS or systemd rather than in libgcrypt
-
Weaknesses in a standardised algorithm rather than in this implementation of it
-
Caller misuse of the API where the documented contract was broken
-
Distribution patches and packaging choices rather than upstream libgcrypt
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-41989 | Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt. | Medium 6.7 | 23 Apr 2026 |
| CVE-2026-41990 | Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data. | Medium 4.0 | 23 Apr 2026 |
| CVE-2026-24881 | In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffer overflow in gpg-agent during PKDECRYPT--kem=CMS handling. This can easily be leveraged for denial of service; however, there is also memory corruption that could lead to remote code execution. | High 8.1 | 27 Jan 2026 |
| CVE-2026-24882 | In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys. | High 8.4 | 27 Jan 2026 |
| CVE-2026-24883 | In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set to a NULL value, leading to a denial of service (application crash). | Low 3.7 | 27 Jan 2026 |
| CVE-2025-68973 | In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.) | High 7.8 | 28 Dec 2025 |
| CVE-2025-68972 | In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintex | Medium 5.9 | 27 Dec 2025 |
| CVE-2025-30258 | In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS." | Low 2.7 | 19 Mar 2025 |
| CVE-2022-3219 | GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB. | Low 3.3 | 23 Feb 2023 |
| CVE-2022-3515 | A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment. | Critical 9.8 | 12 Jan 2023 |
| CVE-2022-47629 | Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser. | Critical 9.8 | 20 Dec 2022 |
| CVE-2022-34903 | GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line. | Medium 6.5 | 1 Jul 2022 |
| CVE-2021-40528 | The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP. | Medium 5.9 | 6 Sep 2021 |
| CVE-2021-33560 | Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP. | High 7.5 | 8 Jun 2021 |
| CVE-2021-3345 | _gcry_md_block_write in cipher/hash-common.c in Libgcrypt version 1.9.0 has a heap-based buffer overflow when the digest final function sets a large count value. It is recommended to upgrade to 1.9.1 or later. | High 7.8 | 29 Jan 2021 |
| CVE-2020-25125 | GnuPG 2.2.21 and 2.2.22 (and Gpg4win 3.1.12) has an array overflow, leading to a crash or possibly unspecified other impact, when a victim imports an attacker's OpenPGP key, and this key has AEAD preferences. The overflow is caused by a g10/key-check.c error. NOTE: GnuPG 2.3.x is unaffected. GnuPG 2.2.23 is a fixed version. | High 7.8 | 3 Sep 2020 |
| CVE-2019-14855 | A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18. | High 7.5 | 20 Mar 2020 |
| CVE-2014-3591 | Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determining factors using crafted ciphertext and the fluctuations in the electromagnetic field during multiplication. | Medium 4.2 | 29 Nov 2019 |
| CVE-2015-0837 | The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information by leveraging timing differences when accessing a pre-computed table during modular exponentiation, related to a "Last-Level Cache Side-Channel Attack." | Medium 5.9 | 29 Nov 2019 |
| CVE-2011-2207 | dirmngr before 2.1.0 improperly handles certain system calls, which allows remote attackers to cause a denial of service (DOS) via a specially-crafted certificate. | Medium 5.3 | 27 Nov 2019 |
| CVE-2015-1606 | The keyring DB in GnuPG before 2.1.2 does not properly handle invalid packets, which allows remote attackers to cause a denial of service (invalid read and use-after-free) via a crafted keyring file. | Medium 5.5 | 20 Nov 2019 |
| CVE-2015-1607 | kbx/keybox-search.c in GnuPG before 1.4.19, 2.0.x before 2.0.27, and 2.1.x before 2.1.2 does not properly handle bitwise left-shifts, which allows remote attackers to cause a denial of service (invalid read operation) via a crafted keyring file, related to sign extensions and "memcpy with overlapping ranges." | Medium 5.5 | 20 Nov 2019 |
| CVE-2019-13050 | Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack. | High 7.5 | 29 Jun 2019 |
| CVE-2019-12904 | In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) NOTE: the vendor's position is that the issue report cannot be validated because there is no description of an attack | Medium 5.9 | 20 Jun 2019 |
| CVE-2018-1000858 | GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in Attacker controlled CSRF, Information Disclosure, DoS. This attack appear to be exploitable via Victim must perform a WKD request, e.g. enter an email address in the composer window of Thunderbird/Enigmail. This vulnerability appears to have been fixed in after commit 4a4bb874f6374 | High 8.8 | 20 Dec 2018 |
| CVE-2017-7526 | libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This side-channel requires that attacker can run arbitrary software on the hardware where the private RSA key is used | Medium 6.1 | 26 Jul 2018 |
| CVE-2018-0495 | Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtu | Medium 4.7 | 13 Jun 2018 |
| CVE-2018-12020 | mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG statu | High 7.5 | 8 Jun 2018 |
| CVE-2018-9234 | GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey. | High 7.5 | 4 Apr 2018 |
| CVE-2018-6829 | cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation. | High 7.5 | 7 Feb 2018 |
| CVE-2017-0379 | Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c. | High 7.5 | 29 Aug 2017 |
| CVE-2017-9526 | In Libgcrypt before 1.7.7, an attacker who learns the EdDSA session key (from side-channel observation during the signing process) can easily recover the long-term secret key. 1.7.7 makes a cipher/ecc-eddsa.c change to store this session key in secure memory, to ensure that constant-time point operations are used in the MPI library. | Medium 5.9 | 11 Jun 2017 |
| CVE-2016-6313 | The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits. | Medium 5.3 | 13 Dec 2016 |
| CVE-2016-4579 | Libksba before 1.3.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via unspecified vectors, related to the "returned length of the object from _ksba_ber_parse_tl." | High 7.5 | 13 Jun 2016 |
| CVE-2016-4574 | Off-by-one error in the append_utf8_value function in the DN decoder (dn.c) in Libksba before 1.3.4 allows remote attackers to cause a denial of service (out-of-bounds read) via invalid utf-8 encoded data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-4356. | High 7.5 | 13 Jun 2016 |
| CVE-2016-4356 | The append_utf8_value function in the DN decoder (dn.c) in Libksba before 1.3.3 allows remote attackers to cause a denial of service (out-of-bounds read) by clearing the high bit of the byte after invalid utf-8 encoded data. | High 7.5 | 13 Jun 2016 |
| CVE-2016-4355 | Multiple integer overflows in ber-decoder.c in Libksba before 1.3.3 allow remote attackers to cause a denial of service (crash) via crafted BER data, which leads to a buffer overflow. | High 7.5 | 13 Jun 2016 |
| CVE-2016-4354 | ber-decoder.c in Libksba before 1.3.3 uses an incorrect integer data type, which allows remote attackers to cause a denial of service (crash) via crafted BER data, which leads to a buffer overflow. | High 7.5 | 13 Jun 2016 |
| CVE-2016-4353 | ber-decoder.c in Libksba before 1.3.3 does not properly handle decoder stack overflows, which allows remote attackers to cause a denial of service (abort) via crafted BER data. | High 7.5 | 13 Jun 2016 |
| CVE-2015-7511 | Libgcrypt before 1.6.5 does not properly perform elliptic-point curve multiplication during decryption, which makes it easier for physically proximate attackers to extract ECDH keys by measuring electromagnetic emanations. | Low 2.0 | 19 Apr 2016 |
| CVE-2014-9087 | Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG, allows remote attackers to cause a denial of service (crash) via a crafted OID in a (1) S/MIME message or (2) ECC based OpenPGP data, which triggers a buffer overflow. | High 7.5 | 1 Dec 2014 |
| CVE-2014-5270 | Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization, which makes it easier for physically proximate attackers to conduct key-extraction attacks by leveraging the ability to collect voltage data from exposed metal, a different vector than CVE-2013-4576. | Low 2.1 | 10 Oct 2014 |
| CVE-2014-4617 | The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24 allows context-dependent attackers to cause a denial of service (infinite loop) via malformed compressed packets, as demonstrated by an a3 01 5b ff byte sequence. | Medium 5.0 | 25 Jun 2014 |
| CVE-2013-4576 | GnuPG 1.x before 1.4.16 generates RSA keys using sequences of introductions with certain patterns that introduce a side channel, which allows physically proximate attackers to extract RSA keys via a chosen-ciphertext attack and acoustic cryptanalysis during decryption. NOTE: applications are not typically expected to protect themselves from acoustic side-channel attacks, since this is arguably the | Low 2.1 | 20 Dec 2013 |
| CVE-2013-4402 | The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message. | Medium 5.0 | 28 Oct 2013 |
| CVE-2013-4351 | GnuPG 1.4.x, 2.0.x, and 2.1.x treats a key flags subpacket with all bits cleared (no usage permitted) as if it has all bits set (all usage permitted), which might allow remote attackers to bypass intended cryptographic protection mechanisms by leveraging the subkey. | Medium 5.8 | 10 Oct 2013 |
| CVE-2013-4242 | GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and possibly other products, allows local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache, aka Flush+Reload. | Low 1.9 | 19 Aug 2013 |
| CVE-2012-6085 | The read_block function in g10/import.c in GnuPG 1.4.x before 1.4.13 and 2.0.x through 2.0.19, when importing a key, allows remote attackers to corrupt the public keyring database or cause a denial of service (application crash) via a crafted length field of an OpenPGP packet. | Medium 5.8 | 24 Jan 2013 |
| CVE-2010-2547 | Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a certificate with a large number of Subject Alternate Names, which is not properly handled in a realloc operation when importing the certificate or verifying its signature. | High 8.1 | 5 Aug 2010 |
| CVE-2008-1530 | GnuPG (gpg) 1.4.8 and 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted duplicate keys that are imported from key servers, which triggers "memory corruption around deduplication of user IDs." | High 9.3 | 27 Mar 2008 |
| CVE-2007-1263 | GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection. | Medium 5.0 | 6 Mar 2007 |
| CVE-2006-6169 | Heap-based buffer overflow in the ask_outfile_name function in openfile.c for GnuPG (gpg) 1.4 and 2.0, when running interactively, might allow attackers to execute arbitrary code via messages with "C-escape" expansions, which cause the make_printable_string function to return a longer string than expected while constructing a prompt. | Medium 6.8 | 29 Nov 2006 |
| CVE-2006-3746 | Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial of service (segmentation fault) via a crafted message. | Medium 5.0 | 28 Jul 2006 |
| CVE-2006-3082 | parse-packet.c in GnuPG (gpg) 1.4.3 and 1.9.20, and earlier versions, allows remote attackers to cause a denial of service (gpg crash) and possibly overwrite memory via a message packet with a large length (long user ID string), which could lead to an integer overflow, as demonstrated using the --no-armor option. | Medium 5.0 | 19 Jun 2006 |
| CVE-2005-0366 | The integrity check feature in OpenPGP, when handling a message that was encrypted using cipher feedback (CFB) mode, allows remote attackers to recover part of the plaintext via a chosen-ciphertext attack when the first 2 bytes of a message block are known, and an oracle or other mechanism is available to determine whether an integrity check failed. | Medium 5.0 | 2 May 2005 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 2 Last 12 months 17 Lifetime Side channel / timing 35 % Memory safety 30 % Cryptographic correctness 25 % Denial of service 10 % Latest advisories Loading the feed Overview libgcrypt is the low-level cryptography library of the GnuPG project and a dependency of systemd, GnuTLS and a long list of distribution packages, so it is installed on effectively every Linux system. It performs the arithmetic behind key generation, signing and bulk encryption for callers that never see it directly, and a flaw in one primitive reaches all of them at once. GnuPG has never run a bounty; the funding is donations, grants and paid support contracts, and reports go to a plain-text security address. sorona.xyz pays you directly on qualified, reproduced findings. In scope The GnuPG security page asks for severe security problems by private mail and publishes an explicit threat model for libgcrypt. Beyond the side channel carve-out in that model, it draws no boundary narrower than the library itself The symmetric ciphers and their modes, including the AEAD constructions and their tag verification paths The hash and MAC families, covering the SHA and BLAKE algorithms and the HMAC and CMAC constructions built on them The public key implementations: RSA, DSA, the elliptic curve algorithms, and the key generation and parameter checking around each The multi-precision integer layer, which is the arithmetic every asymmetric operation runs through and the place a carry or reduction defect becomes a key recovery The hand-written assembly selected per CPU feature, along with the portable C fallback that runs where no accelerated path exists The random number generator, its entropy gathering, its reseeding and its behaviour in the early boot and container cases where entropy is scarce The S-expression parser and the public API surface, which handles structured input supplied by the calling application The secure memory subsystem, covering locked pages, the allocator and the wiping guarantees the library advertises Key derivation and password-based key derivation, including the parameter handling that decides the real cost of a crack The self-test and FIPS mode machinery, where a test that passes over a broken implementation is itself the defect Out of scope Cross-VM and hardware-level side channels, which the published threat model places outside the library's boundary Defects in GnuPG, GnuTLS or systemd rather than in libgcrypt, even where libgcrypt is on the call path Weaknesses in a standardised algorithm rather than in this implementation of it Caller misuse of the API where the documented contract was broken Distribution patches and packaging choices rather than upstream libgcrypt Most-valued findings Side channel signals inside the process boundary: timing, cache and branch behaviour in the public key or multi-precision integer code, which the published threat model keeps in scope while ruling out the cross-VM variants Anything in the multi-precision integer layer that produces a wrong result on specific inputs, since a faulty reduction in a signing operation is a private key recovery rather than a crash Memory corruption reachable through the S-expression parser or through any API path where a caller passes structured data it did not author Random number generator weaknesses, particularly in early boot and container environments where entropy is thin and every key on the host derives from the same pool AEAD tag verification or signature verification that accepts what it should reject, because the callers above treat that answer as final Self-test and FIPS mode defects where the library reports a healthy state over an implementation that is not producing correct output Key generation defects that reduce the entropy or the parameter quality of a generated key, since those keys outlive the fix by years Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report by email to the security address published on the GnuPG security page, which is the documented channel for libgcrypt as well as for GnuPG itself Send plain text. The page asks for it explicitly and states that the team does not use a shared OpenPGP key, so do not plan on encrypting to one The published threat model puts cross-VM and hardware-level side channels out of scope. A finding in that class will be declined on policy rather than on merit, so read the model before spending time there Name the version and the build. libgcrypt selects hand-written assembly per CPU feature, and a defect may exist only on one architecture or only in the portable fallback Say which consumer reaches the defect. The same function is called by systemd, GnuTLS and GnuPG itself, and the severity depends entirely on which of those can drive the input The project pays nothing for a report; the funding is donations, grants and support contracts, so there is no reward to negotiate Disclosure Coordinated by email with the GnuPG security team, who publish through project announcements and hand the advisory to distribution security teams rather than filing GitHub advisories. That routing matters for timing: the practical embargo is set by how quickly the distributions can rebuild a package that sits underneath systemd and GnuTLS on every install. Hold the detail until the announcement and the distribution updates are out. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability