mastodon 4.7.2An official fediverse account for GnuPG (GNU Privacy Guard) and Gpg4win. We send announcements, news and commentary about our Open Source software, the LibrePGP/OpenPGP specification, end-to-end cryptography, and related topics.
In English (and sometimes German).
Dear GnuPG packagers and builders, please upgrade libgcrypt to v1.12.2 to remove a denial of service vulnerability (estimated CVSS 3.1: AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H -- 7.5 (HIGH)) Releases of other stable versions of libgcrypt are available as well.
(GnuPG versions >= 2.5.7 are not affected due to the use of a different encryption API.)
See https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html for details.
When looking at the changes towards the new 2.5.19 version of #GnuPG, there are many small things; like a way to use OCB for symmetric-only encryption, a few defect fixes and improvements.
Not that exciting, but maintenance of the well known #LibrePGP, OpenPGPv4 and CMS capable crypto engine.... you may want to know anyhow. ;)
https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html
https://dev.gnupg.org/T7998
Details about the (ongoing) response to https://gpg.fail/ from GnuPG's side:
* https://www.gnupg.org/blog/20251226-cleartext-signatures.html
* https://dev.gnupg.org/T7906 Memory Corruption in ASCII-Armor Parsing
* https://dev.gnupg.org/T7900 (overview)
Please upgrade to GnuPG 2.5.16, 2.4.9 or #Gpg4win 5.0.0-beta479 which already have the fix for what (currently) is seen to be the only major defect: T7906.
(Researchers - Thanks! - found defects in GnuPG, Sequoia-PG, Minisign and age.)
For those with an @lwn@fedi.lwn.net subscription, https://lwn.net/Articles/1054220/ "Responses to gpg.fail" by Joe Brockmeier (January 21, 2026) is available now.
Others will have to wait a few days (until 2026-01-29)
There is a good discussion in the comments.
Important takeaway: Do not use "cleartext" signatures (where the signature is in the file itself) and if you must be _extra_ careful when verifying these.
@letoams @bwh Obviously there is a difference of opinion and a difference of how carrying some arguments are.
To communicate the difference we need some terminology. OpenPGPv4, LibrePGP and OpenPGPv6 are short names of the respective implemented, partly implemented and proposed standards. They shall be neutral towards which one will be considered the better one in the end so the discussion can turn towards the technical merits and advantages and drawbacks for users.