Moderate Security Vulnerability in GnuTLS: Stack Overflow and Denial of Service Risks
Summary
ALSA-2026:4188: Moderate: gnutls security update. Affects gnutls versions < 3.8.3-10.el9_7. Fixed in 3.8.3-10.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GnuTLS is a widely-used library that implements cryptographic protocols such as SSL, TLS, and DTLS, providing secure communication over networks. It is essential for applications that require secure data transmission. The library is utilized in various software packages across different ecosystems, including AlmaLinux. The recent vulnerabilities identified in GnuTLS pose significant risks to applications relying on this library for secure communications.
Vulnerability Detail
The vulnerabilities in GnuTLS include a stack-based buffer overflow in the gnutls_pkcs11_token_init() function (CVE-2025-9820) and a denial of service (DoS) vulnerability due to excessive resource consumption during certificate verification (CVE-2025-14831). These vulnerabilities can lead to application crashes or unauthorized access, compromising the security and integrity of data transmitted over secure channels.
How To Fix
Minimum fixed version
3.8.3-10.el9_7
This is the first release that contains the fix.
sudo dnf update gnutlsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the use of the affected functions or implementing additional validation checks in your application to mitigate the risk of buffer overflow and excessive resource consumption until the package is updated.
Conclusion
The identified vulnerabilities in GnuTLS present moderate risks that can affect the security of applications relying on this library. It is crucial to update to the patched version to safeguard against potential exploits. Regular monitoring and updates are essential for maintaining application security.
See every vulnerability recorded for gnutls →
FAQ
GnuTLS is a library that provides cryptographic protocols for secure communication over networks, including SSL, TLS, and DTLS.
The vulnerabilities include a stack-based buffer overflow in the gnutls_pkcs11_token_init() function and a denial of service vulnerability during certificate verification.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json. Visit Vulert Scanner to check your application without signing up.
The vulnerabilities can lead to application crashes, unauthorized access, and compromise the security of data transmitted over secure channels.
It is recommended to regularly check for updates and apply them promptly to mitigate any security vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for gnutls.
