The researcher, who first uncovered a signature spoofing vulnerability in May 2025, presented several independent flaws at 39c3 in December 2025, including memory corruption in the basic PGP message parser that affected almost all PGP-related workflows. While some vulnerabilities were properly addressed, others were not. One of the earliest flaws found, used as an introduction hook in the 39c3 talk, remains unpatched to this day. Instead of a code fix, GnuPG main developer Werner Koch published a blog post on the first day of 39c3 declaring the widely-used feature 'harmful,' giving the researcher no time to respond. The talk also demonstrates how remaining footguns in the code continue to pose risks, and presents several novel vulnerabilities that the researcher says should never have made it into production. The talk concludes with commentary on responsible disclosure and the role of AI/LLMs in security, using the gpg.fail vulnerabilities as examples.
GPG Vulnerabilities Remain Unpatched, Researcher Claims in Post-CCC Talk
Researcher details disclosure fallout, unaddressed flaws, and novel zero-days at 39c3 follow-up
edit
By LineZotpaper
Published
Read Time2 min
A security researcher has detailed the aftermath of disclosing multiple vulnerabilities in GPG, the widely-used PGP implementation, revealing that some critical flaws remain unpatched months later. In a talk following the 39th Chaos Communication Congress (39c3), the researcher demonstrated how the main developer of GnuPG declared a feature 'harmful' rather than fixing a vulnerability, and presented novel memory corruption bugs.
§
Analysis
Why This Matters
- GPG is a critical tool for secure communication; unpatched vulnerabilities undermine trust in encrypted email, software signing, and package management.
- The dispute between the researcher and the main developer raises questions about responsible disclosure and project governance.
- The presentation of novel vulnerabilities suggests that the GPG codebase continues to have systemic security issues that could affect millions of users.
Background
GPG (GNU Privacy Guard) is a free implementation of the OpenPGP standard used for encryption and signing. It is maintained primarily by Werner Koch and is widely integrated into email clients, package managers, and version control systems. The "gpg.fail" series of vulnerability disclosures began in 2025, when a researcher found multiple flaws in the parser and signature verification logic.
Key Perspectives
- Security Researcher: The vulnerabilities found were serious and should be fixed; declaring a feature 'harmful' without a patch is an inadequate and poorly timed response.
- Werner Koch (GnuPG Maintainer): By publishing a blog post declaring the feature harmful, he may argue that the feature is fundamentally flawed and better avoided than patched—though the researcher notes the timing was disruptive.
- GPG Users: They face continued risk if they rely on unpatched features or are unaware of the vulnerabilities. The lack of a fix for some issues creates a dilemma about whether to continue using GPG or switch to alternatives.
What to Watch
- Whether the newly presented novel vulnerabilities are disclosed and fixed promptly.
- Response from the GnuPG project and Werner Koch to the talk's criticisms.
- Potential impact on adoption of alternative PGP implementations or security tools.