Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
rust-rpm-sequoia can crash when verifying malicious RPM
published 8 months ago
Summary
The rust-rpm-sequoia library, used to check the signatures of Red Hat Package Manager files, can be forced to stop working if it processes a specially crafted RPM file. This causes the system to be unable to verify RPM signatures, effectively a denial of service. Update to a patched version of the library or avoid processing untrusted RPM files until the fix is applied.
What to do
- Update echo rust-rpm-sequoia to version 1.8.0-2+e1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Echo | echo | rust-rpm-sequoia |
< 1.8.0-2+e1 Fix: upgrade to 1.8.0-2+e1
|
Original advisory text
ECHO-2654-d857-4161
References
Timeline
Published28 Feb 2026
Updated24 Jun 2026
First seen24 Jun 2026
Sources
ECHO-2654-d857-4161 · OSV
Track software like this
Free during beta