In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS."

Exploitation of this vulnerability requires the customer to manually import a crafted certificate containing fingerprints that will then be used to verify signatures. Considering the tradeoff between the stability of Amazon Linux and the exploitation complexity of CVE-2025-30258, a fix will not be provided for gnupg2 in Amazon Linux 2 at this time. Users are advised to mitigate this issue by not importing suspicious GPG certificates and deleting any malicious keys from their keyrings.