CVE-2025-67897
Medium
Description
In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a victim an encrypted message with a crafted PKESK or SKESK packet.
SeverityMedium
CVSS5.3
Exploit probability—
ProductSequoia
PublishedDec 14, 2025
First seenDec 14, 2025
Weakness typeCWE-195CWE-195
How to fix
Update
- sequoia-pgp sequoia2.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sequoia-pgp sequoia | v < 2.1.0 | 2.1.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.