CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.

According to the versions of the gnupg2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for     AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to     CVE-2026-34182.(CVE-2026-57062)

Tenable has extracted the preceding description block directly from the EulerOS gnupg2 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for
    AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to
    CVE-2026-34182. (CVE-2026-57062)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786609750 advisory.

  - CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for     AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to     CVE-2026-34182. (CVE-2026-57062)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786609750 advisory.

  - CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for     AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to     CVE-2026-34182. (CVE-2026-57062)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1785557084 advisory.

  - CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for     AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to     CVE-2026-34182. (CVE-2026-57062)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8720-1 advisory.

    It was discovered that GnuPG incorrectly validated authentication tag lengths when parsing CMS messages     encrypted with AES-GCM. An attacker could possibly use this issue to bypass message integrity checks.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the gnupg package has been released.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3243-1 advisory.

    This update for gpg2 fixes the following issue:

    - CVE-2026-57062: CMS parsing in gpgsm mishandles the CMS format for AES-GCM (bsc#1269279).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21385-1 advisory.

    This update for gpg2 fixes the following issue:

    - CVE-2026-57062: CMS parsing in gpgsm mishandles the CMS format for AES-GCM (bsc#1269279).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1912 advisory.

    CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for     AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to     CVE-2026-34182. (CVE-2026-57062)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for     AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to     CVE-2026-34182. (CVE-2026-57062)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
363986	EulerOS 2.0 SP15 : gnupg2 (EulerOS-SA-2026-3977)	Nessus	Huawei Local Security Checks	Local	low
363973	EulerOS 2.0 SP15 : gnupg2 (EulerOS-SA-2026-3911)	Nessus	Huawei Local Security Checks	Local	low
458992	Echo: gnupg2: security update to 2.4.9-5	Tenable Cloud Security	Echo Local Security Checks	Local	low
458992	Echo: gnupg2: security update to 2.4.9-5	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	low
360883	AlmaLinux 9.6 [TuxCare] Security Update: gnupg2 / gnupg2-smime (ALMALINUX9.6:CLSA-2026:1786609750)	Nessus	Alma Linux Local Security Checks	Local	low
360831	Rocky Linux 9.6 [TuxCare] Security Update: gnupg2 / gnupg2-smime (ALMALINUX9.6:CLSA-2026:1786609750)	Nessus	Rocky Linux Local Security Checks	Local	low
352101	AlmaLinux 9.2 [TuxCare] Security Update: gnupg2 / gnupg2-smime (ALMALINUX9.2:CLSA-2026:1785557084)	Nessus	Alma Linux Local Security Checks	Local	low
344616	Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : GnuPG vulnerability (USN-8720-1)	Nessus	Ubuntu Local Security Checks	Local	low
332597	Photon OS 5.0: Gnupg PHSA-2026-5.0-91-0910	Nessus	PhotonOS Local Security Checks	Local	low
330287	SUSE SLED15 / SLES15 Security Update : gpg2 (SUSE-SU-2026:3243-1)	Nessus	SuSE Local Security Checks	Local	low
329300	openSUSE 16 Security Update : gpg2 (openSUSE-SU-2026:21385-1)	Nessus	SuSE Local Security Checks	Local	low
327373	Amazon Linux 2023 : gnupg2, gnupg2-minimal, gnupg2-smime (ALAS2023-2026-1912)	Nessus	Amazon Linux Local Security Checks	Local	low
324562	Photon OS 5.0: Gnupg PHSA-2026-5.0-0910	Nessus	PhotonOS Local Security Checks	Local	low
323654	Linux Distros Unpatched Vulnerability : CVE-2026-57062	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-57062

low

Tenable Plugins

low

low

low

low

low

low

low

low

low

low

low

low

low

low