A flaw in rust‑rpm‑sequoia allows an attacker to craft a malicious RPM file that, when verified, triggers an error in the OpenPGP signature parsing code. This error causes the rpm tool to terminate unconditionally, resulting in a denial of service at the application level. The disruption limits the system’s ability to process RPM files for signature verification, potentially breaking package management and enforcement of software integrity.

The vulnerability affects Red Hat Enterprise Linux 9 and 10, as well as Red Hat Hardened Images that incorporate the rust‑rpm‑sequoia component. No specific version numbers are provided, indicating that any installation of the affected rpm package that includes rust‑rpm‑sequoia may be impacted.

The CVSS score of 4.0 suggests moderate severity, and the EPSS score of less than 1% indicates a very low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying that no widespread, known exploits are in circulation. Attackers would need to supply a crafted RPM file to the target system’s rpm verifier, either by local execution or via any mechanism that allows an attacker to trigger signature checks on the host. Because the flaw causes an unconditional termination of the rpm process, an attacker can render the rpm tool unusable but cannot gain code execution or system compromise.