RNP's packet parser accepts OpenPGP packets with tag value 0. RFC 4880 §4.3 explicitly says: "0 — Reserved - a packet tag MUST NOT have this value."
What happens:
$ rnp --list-packets tag0_input.gpg
:off 0: packet header 0xc001 (tag 0, len 1)
Skipping Unknown pkt: 0
RNP accepts it (exit code 0). GnuPG correctly rejects it:
$ gpg --list-packets tag0_input.gpg
gpg: no valid OpenPGP data found.
Location: src/librepgp/stream-packet.cpp — stream_peek_packet_hdr() / stream_dump_packets_raw()
Impact: Informational / RFC compliance. No direct security impact since the packet content is skipped. But accepting reserved values could cause interop issues or problems if tag 0 gets assigned a meaning in future RFCs.
Found through differential fuzzing (PathDiff), comparing RNP, GnuPG, and PGPy.
RNP's packet parser accepts OpenPGP packets with tag value 0. RFC 4880 §4.3 explicitly says: "0 — Reserved - a packet tag MUST NOT have this value."
What happens:
RNP accepts it (exit code 0). GnuPG correctly rejects it:
Location:
src/librepgp/stream-packet.cpp—stream_peek_packet_hdr()/stream_dump_packets_raw()Impact: Informational / RFC compliance. No direct security impact since the packet content is skipped. But accepting reserved values could cause interop issues or problems if tag 0 gets assigned a meaning in future RFCs.
Found through differential fuzzing (PathDiff), comparing RNP, GnuPG, and PGPy.