Regulatory updates

Critical vulnerability (CVE-2025-47934) in OpenPGP.js

May 21, 2025

A critical vulnerability (CVE-2025-47934) in OpenPGP.js, a widely used JavaScript library for encryption, allows attackers to spoof digital signatures, making altered messages look authentic. This flaw affects versions 5.0.1–5.11.2 and 6.0.0-alpha.0–6.1.0. It poses a risk to services like Proton Mail that rely on the library. The issue has been patched in versions 5.11.3 and 6.1.1. Users are urged to update or, as a temporary fix, verify signatures separately from decryption.

An OpenPGP.js flaw just broke public key cryptography

Categories

• All Posts
• Breach
• CMMC
• CMS
• Third-party
• Vulnerability

Recent Posts

[CMMC DIB Readiness Updates

Oct 6, 2025](/content/regulatory-updates/f/cmmc-dib-readiness-updates/index.html)

[eSIM security flaw

Jul 14, 2025](/content/regulatory-updates/f/esim-security-flaw/index.html)

[Third-party breach affects Scania

Jun 18, 2025](/content/regulatory-updates/f/third-party-breach-affects-scania/index.html)