GnuTLS CVE-2025-14831 GNUTLS-SA-2026-02-09-2

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 23:08 vuln.today

DescriptionCVE.org

Alpine Linux: gnutls fixed in 3.8.12-r0

AnalysisAI

GnuTLS on Alpine Linux contains a vulnerability addressed in the Alpine package gnutls-3.8.12-r0. The vulnerability is tracked under GnuTLS upstream advisory GNUTLS-SA-2026-02-09-2. Due to the near-total absence of technical detail in available intelligence - no CVSS vector, no CWE classification, no description of the flaw class - the specific impact, affected attack surface, and exploitation conditions cannot be characterized from this data alone.

Technical ContextAI

GnuTLS is a widely-used TLS/SSL and cryptographic library that underpins secure communications in many Linux applications and services. On Alpine Linux, it is distributed as a package; version 3.8.12-r0 is the patched release according to the Alpine vendor report. The upstream advisory identifier GNUTLS-SA-2026-02-09-2 suggests this is a GnuTLS project-level security advisory dated to early 2026. Without a CWE classification or CVE description, the root cause class - whether a memory safety issue, cryptographic weakness, certificate validation bypass, or other flaw - cannot be determined from the provided data.

Affected ProductsAI

Alpine Linux systems running a version of the gnutls package prior to 3.8.12-r0 are confirmed affected per the vendor report. The GnuTLS upstream advisory GNUTLS-SA-2026-02-09-2 may also identify affected upstream GnuTLS release versions, but those version bounds are not present in the available data. No CPE strings were provided. Administrators running other Linux distributions should consult their respective vendor advisories to determine if their GnuTLS packages are affected by the same underlying upstream issue.

RemediationAI

On Alpine Linux, upgrade the gnutls package to version 3.8.12-r0 or later using the standard Alpine package manager: 'apk upgrade gnutls'. This is the vendor-confirmed patched version. For the upstream GnuTLS fix, consult the GNUTLS-SA-2026-02-09-2 advisory at the GnuTLS project's security page, as the corresponding upstream fixed release version is not present in the available data. If immediate patching is not feasible, consider restricting access to services that depend heavily on GnuTLS for TLS termination until the patch can be applied, though this trade-off must be weighed against service availability requirements. No specific workarounds are documented in the available data.