Moderate Vulnerability in GnuTLS Package: Stack-based Buffer Overflow and Denial of Service
Summary
ALSA-2026:3477: Moderate: gnutls security update. Affects gnutls versions < 3.8.10-3.el10_1. Fixed in 3.8.10-3.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
GnuTLS is a widely used library that implements cryptographic protocols such as SSL, TLS, and DTLS. It provides secure communication over networks by ensuring data integrity and confidentiality. The library is essential for applications that require secure data transmission, making it a critical component in many software systems. However, vulnerabilities in GnuTLS can lead to severe security risks, including unauthorized access and denial of service.
Vulnerability Detail
The GnuTLS package has been identified with two significant vulnerabilities. The first, a stack-based buffer overflow in the gnutls_pkcs11_token_init() function (CVE-2025-9820), can allow an attacker to execute arbitrary code, potentially compromising the system. The second vulnerability (CVE-2025-14831) allows for a denial of service through excessive resource consumption during certificate verification, which can disrupt service availability and degrade performance.
How To Fix
Minimum fixed version
3.8.10-3.el10_1
This is the first release that contains the fix.
sudo dnf update gnutlsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the resources allocated to certificate verification processes or implement rate limiting to mitigate the denial of service risk. However, these are not permanent solutions and should not replace updating the package.
Conclusion
The GnuTLS package has critical vulnerabilities that can lead to severe security risks, including unauthorized access and denial of service. It is crucial to update to the patched version to protect your systems. Utilize tools like Vulert to monitor your applications for vulnerabilities effectively.
See every vulnerability recorded for gnutls →
FAQ
GnuTLS is a library that provides secure communication protocols such as SSL and TLS, ensuring data integrity and confidentiality over networks.
The vulnerabilities can lead to unauthorized code execution and denial of service, compromising system security and availability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
Yes, a patched version of the GnuTLS package is available. Update to version 3.8.10-3.el10_1 or later to mitigate the vulnerabilities.
Implement temporary workarounds such as resource limiting or rate limiting, but prioritize updating the package as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for gnutls.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
