gnupg-2.5.24

[Bruce Dubbs]

New point version.

[Joe Locash]

Noteworthy changes in version 2.5.23 (2026-09-22)
-------------------------------------------------

 * New and extended features:

   - gpg: New option --allow-9980 to enable the processing of RFC-9980
     specified data structures.  The use of this option is only
     recommended if external policy requirements demand the use of
     these governmental approved specification.  PGP folks requiring
     some PQC resistance should keep on using the standard LibrePGP
     Kyber algorithm introduced 2 years ago.  [rG6803ce215c]

   - gpg: In 9980 mode support PQC encryption using ML-KEM (aka Kyber)
     with X448, X25519, Brainpool, or NIST curves as specified by
     RFC-9980 et al.

   - gpg: In 9980 mode support ED25519 and X25519 as specified by
     RFC-9580 under the names "ietf27" and "ietf27".

   - gpg: Add experimental support for a --compliance=fips mode to use
     GCM for bulk encryption.  [rG05c271f45a]

   - scd: Add Nitrokey 3 to pcsc-shared interference detection.
     [T8331]

 * Bug fixes:

   - gpgsm: Fix an exploitable printf bug when using the debug option
     "--debug x509".  [rGe6d92ff7af]

   - dirmngr: Make the LDAP upload flags also work for KS_SEARCH.
     [T7866]

   - dirmngr: Fix OOB read in DNS CERT record parser.  [T8464]

   - scd: Fix OOB access in DO parsing of faulty cards.  [T8465]

 * Other changes:

   - dirmngr: Add a mitigation for badly configured web key
     directories.  [rFbc7686ad7c]

   - New option --debug-no-libgcrypt for gpg, gpgsm, and agent.  This
     debug option is useful to avoid cluttering other debug output
     with libgcrypt generated debug details.

   - gpg: New --list-options "debug-show-sexp" to print a secret key
     as an s-expression.  [rG1e0261fe50]


 Release-info: https://dev.gnupg.org/T8425

Fixed at e0af852e23.

[Bruce Dubbs]

Now at version 2.5.24.

[Joe Locash]

Noteworthy changes in version 2.5.24 (2026-09-23)
-------------------------------------------------

 * Bug fixes:

   - scd: Fix for regression in 2.5.23 related to the new Nitrokey
     detection.  [T8331]


 Release-info: https://dev.gnupg.org/T8425

Fixed at 72bec89c81.