GnuTLS CVE-2025-32990 GNUTLS-SA-2025-07-08-3

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 23:08 vuln.today

DescriptionCVE.org

Alpine Linux: gnutls fixed in 3.8.11-r0

AnalysisAI

GnuTLS received a security fix in Alpine Linux package version 3.8.11-r0, corresponding to upstream advisory GNUTLS-SA-2025-07-08-3. The nature of the underlying vulnerability - its class, impact, and attack vector - is not disclosed in the available intelligence data. Alpine Linux's vendor report confirms a patch was issued, but no CVSS scoring, CWE classification, or technical description of the flaw has been published at the time of this analysis. No public exploit identified at time of analysis and no CISA KEV listing is present.

Technical ContextAI

GnuTLS is a widely deployed open-source TLS/SSL and DTLS library used across Linux distributions, embedded systems, and server software to implement cryptographic protocols. It is a core dependency in many Alpine Linux-based containers and appliances. The advisory identifier GNUTLS-SA-2025-07-08-3 indicates this is the third in a batch of GnuTLS security advisories released on or around that date, suggesting coordinated disclosure of multiple issues. Without a CWE classification or description, the root cause class - whether memory safety, cryptographic weakness, certificate validation bypass, or another category - cannot be determined from available data. The CPE string for the affected package is not provided in the input.

Affected ProductsAI

GnuTLS as packaged in Alpine Linux is confirmed affected, with the fix released in Alpine Linux package gnutls 3.8.11-r0. Versions prior to 3.8.11-r0 on Alpine Linux should be considered affected. The exact upstream GnuTLS version range (e.g., which upstream release introduced or closed the flaw) is not specified in the available data. Other Linux distributions shipping GnuTLS may also be affected, but no cross-distribution CPE data or advisory cross-references were provided. The Alpine Linux security tracker and the upstream GnuTLS advisory GNUTLS-SA-2025-07-08-3 should be consulted for definitive scope.

RemediationAI

Upgrade the Alpine Linux gnutls package to version 3.8.11-r0 or later using 'apk upgrade gnutls'. This is the vendor-confirmed fix per Alpine Linux. For systems where immediate patching is not possible, consider restricting network exposure of services that depend on GnuTLS for TLS termination until the patch can be applied; however, without knowing the vulnerability class (e.g., whether it requires a client or server role, specific cipher negotiation, or client-supplied input), targeted workarounds cannot be responsibly specified. Review the upstream GnuTLS advisory GNUTLS-SA-2025-07-08-3 at the GnuTLS project site for upstream advisory details and any documented mitigations. Container images based on Alpine Linux should be rebuilt with the patched base layer.