CVE-2021-40528

The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.

• CWE-327
• CWE-327

• https://eprint.iacr.org/2021/923Technical Description, Third Party Advisory
• https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=3462280f2e23e16adf3ed5176e0f2413d8861320
• https://ibm.github.io/system-security-research-updates/2021/07/20/insecurity-elgamal-pt1Third Party Advisory
• https://ibm.github.io/system-security-research-updates/2021/09/06/insecurity-elgamal-pt2Exploit, Third Party Advisory
• https://security.gentoo.org/glsa/202210-13Third Party Advisory
• https://eprint.iacr.org/2021/923Technical Description, Third Party Advisory
• https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=3462280f2e23e16adf3ed5176e0f2413d8861320
• https://ibm.github.io/system-security-research-updates/2021/07/20/insecurity-elgamal-pt1Third Party Advisory
• https://ibm.github.io/system-security-research-updates/2021/09/06/insecurity-elgamal-pt2Exploit, Third Party Advisory
• https://security.gentoo.org/glsa/202210-13Third Party Advisory

Published

Sep 6, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-40521Airangel HSMX Gateway devices through 5.2.04 allow Remote Co…9.8
• CVE-2021-40523In Contiki 3.0, Telnet option negotiation is mishandled. Dur…7.5
• CVE-2021-40524In Pure-FTPd before 1.0.50, an incorrect max_filesize quota …7.5
• CVE-2021-40525Apache James ManagedSieve implementation alongside with the …9.1
• CVE-2021-40526Incorrect calculation of buffer size vulnerability in Peleto…5.3
• CVE-2021-40527Exposure of senstive information to an unauthorised actor in…7.5
• CVE-2021-40529The ElGamal implementation in Botan through 2.18.1, as used …5.9
• CVE-2021-4053Use after free in UI in Google Chrome on Linux prior to 96.0…8.8
• CVE-2021-40530The ElGamal implementation in Crypto++ through 8.5 allows pl…5.9
• CVE-2021-40531Sketch before 75 allows library feeds to be used to bypass f…9.8
• CVE-2021-40532Telegram Web K Alpha before 0.7.2 mishandles the characters …9.8
• CVE-2021-40537Server Side Request Forgery (SSRF) vulnerability exists in o…2.7