Skip to main content

Gnutls CVE-2025-32990

| EUVDEUVD-2025-20990 HIGH
Heap-based Buffer Overflow (CWE-122)
2025-07-10 secalert@redhat.com
Buffer Overflow Heap Overflow Red Hat Enterprise Linux Gnutls Openshift Container Platform Gnu
8.2
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-122
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 27, 2026

Denial-of-service via heap buffer overflow in GnuTLS certtool utility could crash the system. When certtool parses certain settings from a crafted template file, an off-by-one error leads to an out-of-bounds NULL write, corrupting memory. Affected products include GnuTLS on Red Hat Enterprise Linux, OpenShift Container Platform, Ubuntu, and Debian; vendor patches are available. No active exploitation or public proof-of-concept is known, and EPSS score is very low (0.05%).

Affected VersionsENISA

Red Hat Enterprise Linux 9.4 Extended Update Support patch: 0:3.8.3-4.el9_4.4
Red Hat Insights proxy 1.5 patch: sha256:8eb6b896e1eac4080a564e146f95c4166e47ca137083b37119027c6a77011207
Red Hat Enterprise Linux 10 patch: 0:3.8.9-9.el10_0.14
Red Hat Enterprise Linux 8 patch: 0:3.6.16-8.el8_10.4
Red Hat Ceph Storage 7 patch: sha256:6b79ed10423d954d21dd24c9cb1cf507f6e02c2942ace7fa30cf7af2ffaeb631
Red Hat Enterprise Linux 9 patch: 0:3.8.3-6.el9_6.2
Red Hat Insights proxy 1.5 patch: sha256:4ca38b33efec0d2dd17a8fd822a7c18281810676ceabb0c1db90953cb91cd5ea
Red Hat Discovery 2 patch: sha256:4784c2680572f9d091fcfb8c593d5424c0fcd8ea9cd51d25ddaf2f72abc7da65
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions patch: 0:3.7.6-21.el9_2.4
Red Hat Discovery 2 patch: sha256:435ba9959b793d46a63a74c343bb8c3ff68350496afec12cc5e894dfc40b7648

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Gnutls gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Ubuntu MEDIUM
SUSE 6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Red Hat 6.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
High

Lifecycle Timeline

5
Severity Changed
Jun 25, 2026 - 05:22 NVD
MEDIUM HIGH
CVSS changed
Jun 25, 2026 - 05:22 NVD
6.5 (MEDIUM) 8.2 (HIGH)
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Jul 10, 2025 - 10:15 nvd
HIGH 8.2
CVE Published
Jul 10, 2025 - 10:15 nvd
MEDIUM 6.5

DescriptionNVD

A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds (OOB) NULL pointer write, resulting in memory corruption and a denial-of-service (DoS) that could potentially crash the system.

Threat Intelligence Overview

EPSS Score
0.1%
Top 84% exploitable
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact· derived
Medium

Priority Score

41
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +41
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.

More in Gnutls

View all
CVE-2021-20231 CRITICAL POC
9.8 Mar 12

A flaw was found in gnutls. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentic
CVE-2014-3466 MEDIUM POC
6.8 Jun 03

Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.15
CVE-2020-24659 HIGH POC
7.5 Sep 04

An issue was discovered in GnuTLS before 3.6.15. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
CVE-2024-0553 HIGH POC
7.5 Jan 16

A vulnerability was found in GnuTLS. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no auth
CVE-2024-0567 HIGH POC
7.5

Alpine Linux: gnutls fixed in 3.8.3-r0
CVE-2012-1663 HIGH POC
7.5 Mar 13

Double free vulnerability in libgnutls in GnuTLS before 3.0.14 allows remote attackers to cause a denial of service (app
CVE-2023-0361 HIGH POC
7.4 Feb 15

A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. Rated high severity (C
CVE-2019-3836 HIGH POC
7.5 Apr 01

It was discovered in gnutls before version 3.6.7 upstream that there is an uninitialized pointer access in gnutls versio
CVE-2019-3829 HIGH POC
7.5 Mar 27

A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7. Rated high severity (CVSS 7.5), this vulnerability
CVE-2012-1569 MEDIUM POC
5.0 Mar 26

The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before 3.0.16 and other pr
CVE-2017-5334 CRITICAL
9.8 Mar 24

Double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 al
CVE-2012-1573 MEDIUM POC
5.0 Mar 26

gnutls_cipher.c in libgnutls in GnuTLS before 2.12.17 and 3.x before 3.0.15 does not properly handle data encrypted with

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2026-94127 CRITICAL POC
9.3
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

Ubuntu

Priority: Medium
gnutls28
Release Status Version
upstream released 3.8.9-3
jammy released 3.7.3-4ubuntu1.7
noble released 3.8.3-1.1ubuntu3.4
plucky released 3.8.9-2ubuntu3.1
oracular ignored end of life, was needs-triage
bionic released 3.5.18-1ubuntu1.6+esm2
focal released 3.6.13-2ubuntu1.12+esm1
xenial released 3.4.10-4ubuntu1.9+esm2
questing released 3.8.9-3ubuntu1
USN-7635-1 USN-7742-1

Debian

gnutls28
Release Status Fixed Version Urgency
bullseye fixed 3.7.1-5+deb11u8 -
bullseye (security) fixed 3.7.1-5+deb11u9 -
bookworm fixed 3.7.9-2+deb12u5 -
bookworm (security) fixed 3.7.9-2+deb12u6 -
trixie (security), trixie fixed 3.8.9-3+deb13u2 -
forky, sid fixed 3.8.12-3 -
(unstable) fixed 3.8.9-3 -
DLA-4267-1 DSA-5962-1

SUSE

Severity: Medium
Product Status
Container bci/kiwi:latest Container bci/spack:0.23.1-11.31 Container containers/lmcache-vllm-openai:0.3.2-1.2 Container containers/open-webui:0.6.9-11.8 Container containers/vllm-openai:0.9.1-1.2 Container suse/manager/5.0/x86_64/server:5.0.5.1.7.33.2 Container suse/multi-linux-manager/5.1/x86_64/server:5.1.1.8.7.1 Image SLES15-SP6 Image SLES15-SP6-Azure-3P Image SLES15-SP6-Azure-Basic Image SLES15-SP6-Azure-Standard Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-Azure Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-BYOS-GCE Image SLES15-SP6-CHOST-BYOS Image SLES15-SP6-CHOST-BYOS-Aliyun Image SLES15-SP6-CHOST-BYOS-Azure Image SLES15-SP6-CHOST-BYOS-EC2 Image SLES15-SP6-CHOST-BYOS-GCE Image SLES15-SP6-CHOST-BYOS-GDC Image SLES15-SP6-CHOST-BYOS-SAP-CCloud Image SLES15-SP6-EC2 Image SLES15-SP6-EC2-ECS-HVM Image SLES15-SP6-GCE Image SLES15-SP6-HPC Image SLES15-SP6-HPC-Azure Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-BYOS-GCE Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-HPC-GCE Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-Azure Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-Hardened-BYOS-GCE Image SLES15-SP6-SAP Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-Azure-LI-BYOS Image SLES15-SP6-SAP-Azure-LI-BYOS-Production Image SLES15-SP6-SAP-Azure-VLI-BYOS Image SLES15-SP6-SAP-Azure-VLI-BYOS-Production Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAP-GCE Image SLES15-SP6-SAPCAL Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP6-SAPCAL-EC2 Image SLES15-SP6-SAPCAL-GCE Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-EC2 Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-GCE-3P Image SLES15-SP7-HPC-Azure Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-Azure-LI-BYOS-Production Image SLES15-SP7-SAP-Azure-VLI-BYOS-Production Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-GCE-3P Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Image ai_15_6 Image server-image Affected
Container suse/sl-micro/6.0/baremetal-os-container:latest Affected
Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
Image SLES12-SP5-Azure-BYOS Image SLES12-SP5-Azure-HPC-BYOS Image SLES12-SP5-Azure-HPC-On-Demand Image SLES12-SP5-Azure-Standard-On-Demand Image SLES12-SP5-EC2-BYOS Image SLES12-SP5-EC2-On-Demand Image SLES12-SP5-GCE-BYOS Image SLES12-SP5-GCE-On-Demand Affected
Image SLES12-SP5-Azure-SAP-BYOS Image SLES12-SP5-Azure-SAP-On-Demand Image SLES12-SP5-EC2-SAP-BYOS Image SLES12-SP5-EC2-SAP-On-Demand Image SLES12-SP5-GCE-SAP-BYOS Image SLES12-SP5-GCE-SAP-On-Demand Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/security/cve/CVE-2025-32990 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-32990 ADVISORY https://security-tracker.debian.org/tracker/dla-4267-1 ADVISORY https://security-tracker.debian.org/tracker/dsa-5962-1 ADVISORY https://ubuntu.com/security/notices/USN-7635-1 ADVISORY https://ubuntu.com/security/notices/USN-7742-1 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02340/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02520/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02521/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02583/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02589/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:02595/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20563/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20665/ REF http://www.openwall.com/lists/oss-security/2025/07/11/3 REF https://access.redhat.com/errata/RHSA-2025:16115 REF https://access.redhat.com/errata/RHSA-2025:16116 REF https://access.redhat.com/errata/RHSA-2025:17181 REF https://access.redhat.com/errata/RHSA-2025:17348 REF https://access.redhat.com/errata/RHSA-2025:17361 REF https://access.redhat.com/errata/RHSA-2025:17415 REF https://access.redhat.com/errata/RHSA-2025:19088 REF https://access.redhat.com/errata/RHSA-2025:22529 REF https://access.redhat.com/errata/RHSA-2026:7477 REF https://bugzilla.redhat.com/show_bug.cgi?id=2359620 REF https://lists.debian.org/debian-lts-announce/2025/08/msg00005.html REF https://lists.gnupg.org/pipermail/gnutls-help/2025-July/004883.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy