CVE-2019-13050

What it actually does

The interaction allows an attacker-controlled flood of certificates from the SKS network to be retrieved by GnuPG clients, resulting in persistent resource exhaustion and denial of service on key operations.

Why it matters to the business

Systems that rely on GPG for signature verification or encryption may experience prolonged outages or degraded performance when key retrieval is triggered, affecting secure communications and software distribution pipelines.

How an attack unfolds

An attacker spams the SKS keyserver network with a large volume of certificates; any GnuPG instance configured to query the network then pulls the malicious data during normal key refresh or import operations, causing the client to become unresponsive.

How to fix it

Remove or replace any keyserver configuration lines that reference the SKS network; migrate to alternative keyservers such as keys.openpgp.org; upgrade GnuPG beyond 2.2.16 and SKS beyond 1.2.0 where possible; avoid automated key fetches from untrusted sources.

How to confirm the fix worked

Inspect gpg.conf and dirmngr.conf files for references to sks-keyservers.net or similar hosts; attempt key retrieval from a test system and monitor for resource spikes; verify that key operations complete without exhaustion after configuration changes.

Typical attack path

1. Identify GnuPG deployments with keyserver lines pointing to sks-keyservers.net or equivalent SKS hosts
2. Inject or amplify a large number of certificates into the SKS network
3. Trigger key retrieval or synchronization from affected GnuPG clients
4. Observe persistent high CPU, memory, or disk usage leading to denial of service

How to detect it

Search system and application logs for repeated or large-volume key import operations; monitor process resource usage during gpg or dirmngr activity; review historical configuration files for legacy SKS references.

• sks-keyservers.net
• hkp://pool.sks-keyservers.net
• gpg: keyserver receive failed
• excessive keyring growth during --recv-keys

What your security team should do

• Immediately audit all GnuPG configurations across the environment for SKS keyserver references
• Replace SKS keyserver entries with hardened alternatives and disable automatic key retrieval where feasible
• Monitor for high resource consumption during GPG key operations as an interim detection measure
• Prioritize upgrades of GnuPG and related packages on internet-facing or critical systems