CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.

The remote Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8720-1 advisory.

    It was discovered that GnuPG incorrectly validated authentication tag lengths when parsing CMS messages     encrypted with AES-GCM. An attacker could possibly use this issue to bypass message integrity checks.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the gnupg package has been released.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3243-1 advisory.

    This update for gpg2 fixes the following issue:

    - CVE-2026-57062: CMS parsing in gpgsm mishandles the CMS format for AES-GCM (bsc#1269279).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21385-1 advisory.

    This update for gpg2 fixes the following issue:

    - CVE-2026-57062: CMS parsing in gpgsm mishandles the CMS format for AES-GCM (bsc#1269279).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1912 advisory.

    CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for     AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to     CVE-2026-34182. (CVE-2026-57062)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for     AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to     CVE-2026-34182. (CVE-2026-57062)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
344616	Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : GnuPG vulnerability (USN-8720-1)	Nessus	Ubuntu Local Security Checks	Local	low
332597	Photon OS 5.0: Gnupg PHSA-2026-5.0-91-0910	Nessus	PhotonOS Local Security Checks	Local	low
330287	SUSE SLED15 / SLES15 Security Update : gpg2 (SUSE-SU-2026:3243-1)	Nessus	SuSE Local Security Checks	Local	low
329300	openSUSE 16 Security Update : gpg2 (openSUSE-SU-2026:21385-1)	Nessus	SuSE Local Security Checks	Local	low
327373	Amazon Linux 2023 : gnupg2, gnupg2-minimal, gnupg2-smime (ALAS2023-2026-1912)	Nessus	Amazon Linux Local Security Checks	Local	low
324562	Photon OS 5.0: Gnupg PHSA-2026-5.0-0910	Nessus	PhotonOS Local Security Checks	Local	low
323654	Linux Distros Unpatched Vulnerability : CVE-2026-57062	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-57062

low

Tenable Plugins

low

low

low

low

low

low

low