CVE-2024-0553

CVE-2024-0553 affects GnuTLS and describes a timing side‑channel in RSA-PSK ClientKeyExchange that could leak data. Multiple connected advisories confirm affected package versions and provide fixes: Debian/Red Hat‑based mariners list upgrades to mitigate (examples include gnutls >= 3.7.11-1 or...

CVE-2023-0361

CVE-2023-0361 describes a timing side-channel in GnuTLS during RSA ClientKeyExchange handling that can enable Bleichenbacher-style attacks to recover the RSA key and decrypt accompanying application data. The vulnerability affects GnuTLS implementations across multiple advisories and distribution...

CVE-2020-13777

GnuTLS 3.6.x before 3.6.14 is affected by a flaw in how the TLS session-ticket encryption key is constructed, caused by an 2018-09-18 commit. The earliest affected version is 3.6.4 . Until the first key rotation, the TLS server uses incorrect data in place of a key derived from the application, l...

CVE-2022-2509

CVE-2022-2509 is a vulnerability in the GnuTLS library (gnutls) caused by a double free during verification of PKCS7 signatures in gnutls_pkcs7_verify. Connected documents show affected packages across several ecosystems (e.g., Debian gnutls28, AlmaLinux gnutls, Cloud Foundry USN). The root cause...

CVE-2020-24659

GnuTLS up to version 3.6.14 is affected by CVE-2020-24659. The issue is described as a heap buffer overflow during TLS handshake involving a no_renegotiation alert and an invalid second handshake, with the crash occurring in the error handling path when gnutls_deinit is called after a handshake f...

CVE-2020-11501

CVE-2020-11501 affects GnuTLS 3.6.x prior to 3.6.13. The DTLS client uses 32 null bytes instead of random values during DTLS negotiations, removing randomness and breaking DTLS security guarantees. Affected range starts at 3.6.3 (2018-07-16) due to a 2017-10-06 commit. The issue was fixed in 3.6....

CVE-2024-0567

CVE-2024-0567 – GnuTLS issue affects the certificate chain validation when using cockpit-certificate-ensure, causing a denial-of-service that can be triggered by an unauthenticated remote attacker. Documents refer to GnuTLS in cockpit and describe distributed-trust chain rejection as the root cau...

CVE-2019-3829

CVE-2019-3829 affects GnuTLS versions prior to 3.6.7 (including 3.5.8+). The issue is a memory corruption (double free) in the certificate verification API (e.g., verify_crt and gnutls_x509_trust_list_verify_crt). This can enable arbitrary code execution or crash scenarios when a client or server...

CVE-2019-3836

GNUTLS CVE-2019-3836: uninitialized/invalid pointer access in post-handshake message handling (TLS1.3 async messages) on versions prior to 3.6.7. Remote attacker can cause crash/Denial of Service; may enable arbitrary code execution per related advisories. Remediation: upgrade to GNUTLS 3.6.7 or ...

CVE-2017-7507

CVE-2017-7507 affects GnuTLS 3.5.12 and earlier, which are vulnerable to a NULL pointer dereference when decoding a status_request extension in ClientHello, potentially crashing the server. Several connected advisories confirm the issue and provide remediation: upgrade to GnuTLS 3.5.13 or newer (...

CVE-2015-0294

The CVE-2015-0294 entry concerns GnuTLS before 3.3.13, where the library does not validate that the signature algorithms match when importing a certificate. The vulnerability is documented in multiple connected sources (e.g., MiracleLinux AXSA advisory referencing CVE-2015-0294 and vendor advisor...

CVE-2016-7444

CVE-2016-7444 affects GnuTLS: the function gnutls_ocsp_resp_check_crt in lib/x509/ocsp.c fails to verify the serial length of OCSP responses, due to trailing bytes from gnutls_malloc. This can allow remote attackers to bypass certificate validation. Affected versions are GnuTLS before 3.4.15 and ...

CVE-2017-5335

GnuTLS CVE-2017-5335 affects the OpenPGP certificate handling in lib/opencdk/read-packet.c: streams reading certificates can trigger an out-of-memory crash via crafted OpenPGP data. Affected versions are GnuTLS before 3.3.26 and 3.5.x before 3.5.8. Multiple external advisories (CentOS, Red Hat, U...

CVE-2009-2730

CVE-2009-2730 affects GnuTLS libgnutls where a NULL character in a domain name (CN or SAN) of an X.509 certificate is not handled correctly, enabling MITM spoofing of SSL servers if a crafted cert from a trusted CA is issued. Affected product/version: libgnutls in GnuTLS prior to 2.8.2. Impact: p...

CVE-2014-3468

The CVE concerns GNU Libtasn1 prior to version 3.6, where asn1_get_bit_der does not properly report an error for a negative bit length. This can enable context-dependent attackers to trigger out-of-bounds access via crafted ASN.1 data, potentially impacting applications using libtasn1. Public ref...

CVE-2017-7869

GnuTLS contains a vulnerability CVE-2017-7869: an out-of-bounds write caused by an integer overflow and heap-based buffer overflow in cdk_pkt_read (opencdk/read-packet.c). This affects older GnuTLS before 2017-02-20 and is a subset of GNUTLS-SA-2017-3; the issue can crash the application (denial ...

CVE-2015-3308

CVE-2015-3308: A double-free in GnuTLS’ lib/x509/x509_ext.c when parsing CRL distribution points (vulnerable in GnuTLS releases before 3.3.14) may allow remote DoS or other impact. Affected component: x509_ext.c; root cause: double-free; impact: DoS and possible unspecified effects; remediation: ...

CVE-2010-0731

GnuTLS before 1.2.1 (BE, 64‑bit) contains a flaw in gnutls_x509_crt_get_serial that decodes ASN.1 data with the wrong type/length, allowing a crafted X.509 certificate to bypass CRL checks and potentially cause a stack-based overflow. This vulnerability is addressed by Red Hat/CentOS OpenVAS advi...

CVE-2016-4456

The CVE-2016-4456 issue affects GnuTLS, specifically version 3.4.12. The vulnerability stems from how GNUTLS_KEYLOGFILE is handled via getenv(), which can allow an attacker to overwrite and corrupt arbitrary files in the filesystem. Several connected sources confirm the impact and the affected co...

CVE-2008-2377

CVE-2008-2377 is a use-after-free in GNU TLS: the _gnutls_handshake_hash_buffers_clear function in libgnutls (GnuTLS 2.3.5–2.4.0) can allow a remote attacker to crash the service or potentially run arbitrary code during TLS handshakes, due to improper handling of a deallocated libgcrypt handle. A...

CVE-2026-42009

CVE-2026-42009 affects the GnuTLS library, where DTLS packet reordering uses a comparator that mishandles duplicate sequence numbers. This can cause unstable DTLS packet ordering or undefined behavior, leading to a denial of service. The vulnerability is described consistently across NVD entries ...

CVE-2026-3833

Technical details for CVE-2026-3833 are not publicly available in the provided documents; OpenSUSE/PTSecurity entries reference fixes but do not expose affected components, impact, or mitigation here. Monitor for updates.

CVE-2009-1416

GnuTLS CVE-2009-1416 affects GnuTLS 2.5.0–2.6.5: libgnutls/libgnutls_pk.c generates RSA keys and stores them in DSA structures, enabling remote attackers to spoof certificate signatures or cause unspecified impact via an invalid DSA key. Connected documents reference CVE IDs and advisories; no im...

CVE-2012-1663

CVE-2012-1663 describes a double-free vulnerability in libgnutls (GnuTLS) before 3.0.14, allowing remote attackers to cause a denial of service (application crash) or potentially other impact via a crafted certificate list. Public references show exploits and advisories: exploitation activity exi...

CVE-2004-2531

X.509 certificate verification in GnuTLS 1.0.16 can be exploited by sending RSA certificates with very large modulus/exponent values to cause resource exhaustion and a denial of service. The CERT advisory notes cross‑vendor impact and that patches/updates have been released by vendors; apply the ...

CVE-2026-1584

The CVE-2026-1584 entry concerns gnutls. A remote, unauthenticated attacker can trigger a NULL pointer dereference during TLS via a crafted ClientHello that has an invalid PSK binder, causing a server crash and remote DoS. Connected documents confirm this vulnerability across multiple sources (NV...