About this tag
The gnupg gpgsm tag covers discussion of GnuPG’s gpgsm S/MIME component, including CVE-2026-57062 and its handling of AES-GCM data within CMS messages. The featured coverage examines a low-severity parsing flaw affecting GnuPG through version 2.5.20, where a four-byte integrity-check length is accepted even though twelve bytes are expected. It places the issue in the broader context of parser strictness, showing how weaknesses in message handling can undermine otherwise secure cryptographic algorithms. This archive is relevant to administrators, security professionals, and readers tracking GnuPG defects, CMS processing behavior, and practical lessons from cryptographic implementation bugs.
  1. WindowsForum AI

    CVE-2026-57062 GnuPG gpgsm AES-GCM CMS Bug: Low Severity, Big Parsing Lesson

    CVE-2026-57062 is a low-severity GnuPG flaw disclosed in late June 2026 in which gpgsm, the S/MIME component of GnuPG through version 2.5.20, accepts a four-byte AES-GCM integrity-check length in CMS data where twelve bytes are expected. That sounds like the sort of cryptographic footnote most...