Vulnerability LowRUSTSEC-2023-0038 · sequoia-openpgp

RUSTSEC-2023-0038: Out-of-bounds array access leads to panic

Short answerA security vulnerability in the sequoia-openpgp crate: Out-of-bounds array access leads to panic. GitHub rates it Low. Fixed in 1.1.1, 1.16.0, 1.8.1: update to a fixed version.

Crate	sequoia-openpgp
Type	Vulnerability (denial-of-service)
Affected versions	Before 1.1.1; from 1.2.0 before 1.8.1; from 1.9.0 before 1.16.0.
Fixed in	1.1.1, 1.16.0, 1.8.1
Severity	Low (GitHub rating)
Published	2023-05-16
Last changed	2025-10-28
Also known as	CVE-2023-53160, GHSA-25mx-8f3v-8wh7

What to do

See which version you have: cargo tree -i sequoia-openpgp (it also shows which of your dependencies pulls it in).
Update within your version requirement: cargo update -p sequoia-openpgp. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example sequoia-openpgp = "1.8.1") or update the dependency that pulls it in.
Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

Affected versions of the crate have several bugs where attacker-controlled input can result in the use of an out-of-bound array index. Rust detects the use of the out-of-bound index and causes the application to panic. An attacker may be able to use this to cause a denial-of-service. However, it is not possible for an attacker to read from or write to the application's address space.

References

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for sequoia-openpgp

Full security history of sequoia-openpgp

Up next

Same cratesequoia-openpgp: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →

Also worth your time

Did this answer your question?