Resource exhaustion in GnuTLS - CVE-2025-14831

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU122491

Resource exhaustion in GnuTLS - CVE-2025-14831

Published: February 10, 2026


Vulnerability identifier: #VU122491
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-14831
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when verifying certificates with a large amount of name constraints. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.


Affected software

GnuTLS
Debian Linux
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Enterprise Micro
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Anolis OS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Basesystem Module
openSUSE Leap
Ubuntu
openEuler
Fedora
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
LANTIME Operating System Firmware (LTOS)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
gnutls28 (Ubuntu package)
gnutls (Red Hat package)
gnutls
gnutls-c++
gnutls-dane
gnutls-utils
gnutls-devel
libgnutls-devel
libgnutlsxx-devel
libgnutlsxx28
libgnutls30-debuginfo
libgnutls30
libgnutls-devel-64bit
libgnutlsxx28-debuginfo
gnutls-guile
gnutls-guile-debuginfo
libgnutls-devel-32bit
libgnutls30-32bit
libgnutls30-hmac-32bit
libgnutls30-hmac
gnutls-debuginfo
gnutls-debugsource
libgnutls30-32bit-debuginfo
libgnutls30-64bit-debuginfo
libgnutls30-hmac-64bit
libgnutls30-64bit
gnutls28 (Debian package)
gnutls-doc
gnutls-help
libgnutlsxx30-debuginfo
libgnutlsxx30
libtasn1 (Red Hat package)

How to mitigate CVE-2025-14831

Install updates from vendor's website.

GnuTLS - update to 3.8.12
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.3.1 Patch 2
LANTIME Operating System Firmware (LTOS) - update to 7.10.009
gnutls28 (Ubuntu package) - addressed in versions 3.4.10-4ubuntu1.9+esm3, 3.5.18-1ubuntu1.6+esm3, 3.6.13-2ubuntu1.12+esm2, 3.7.3-4ubuntu1.8, 3.8.3-1.1ubuntu3.5, 3.8.9-3ubuntu2.1
gnutls (Red Hat package) - addressed in versions 3.6.14-10.el8_4.1, 3.6.16-5.el8_6.5, 3.6.16-8.el8_10.5, 3.7.6-21.el9_2.5, 3.8.3-4.el9_4.5, 3.8.3-6.el9_6.3, 3.8.3-10.el9_7, 3.8.9-9.el10_0.17, 3.8.10-3.el10_1
gnutls - addressed in versions 3.6.16-8.0.2, 3.8.2-5
gnutls-c++ - addressed in versions 3.6.16-8.0.2, 3.8.2-5
gnutls-dane - addressed in versions 3.6.16-8.0.2, 3.8.2-5
gnutls-utils - addressed in versions 3.6.16-8.0.2, 3.8.2-5
gnutls-devel - addressed in versions 3.6.16-8.0.2, 3.8.2-5
libgnutls-devel - addressed in versions 3.7.3-150400.4.56.1, 3.8.3-150600.4.17.1
gnutls - addressed in versions 3.7.3-150400.4.56.1, 3.7.3-150400.24.2, 3.8.3-150600.4.17.1
libgnutlsxx-devel - addressed in versions 3.7.3-150400.4.56.1, 3.8.3-150600.4.17.1
libgnutlsxx28 - update to 3.7.3-150400.4.56.1
libgnutls30-debuginfo - addressed in versions 3.7.3-150400.4.56.1, 3.7.3-150400.24.2, 3.8.3-150600.4.17.1
libgnutls30 - addressed in versions 3.7.3-150400.4.56.1, 3.7.3-150400.24.2, 3.8.3-150600.4.17.1
libgnutls-devel-64bit - addressed in versions 3.7.3-150400.4.56.1, 3.8.3-150600.4.17.1
libgnutlsxx28-debuginfo - update to 3.7.3-150400.4.56.1
gnutls-guile - update to 3.7.3-150400.4.56.1
gnutls-guile-debuginfo - update to 3.7.3-150400.4.56.1
libgnutls-devel-32bit - addressed in versions 3.7.3-150400.4.56.1, 3.8.3-150600.4.17.1
libgnutls30-32bit - addressed in versions 3.7.3-150400.4.56.1, 3.8.3-150600.4.17.1
libgnutls30-hmac-32bit - update to 3.7.3-150400.4.56.1
libgnutls30-hmac - addressed in versions 3.7.3-150400.4.56.1, 3.7.3-150400.24.2
gnutls-debuginfo - addressed in versions 3.7.3-150400.4.56.1, 3.7.3-150400.24.2, 3.8.3-150600.4.17.1
gnutls-debugsource - addressed in versions 3.7.3-150400.4.56.1, 3.7.3-150400.24.2, 3.8.3-150600.4.17.1
libgnutls30-32bit-debuginfo - addressed in versions 3.7.3-150400.4.56.1, 3.8.3-150600.4.17.1
libgnutls30-64bit-debuginfo - addressed in versions 3.7.3-150400.4.56.1, 3.8.3-150600.4.17.1
libgnutls30-hmac-64bit - update to 3.7.3-150400.4.56.1
libgnutls30-64bit - addressed in versions 3.7.3-150400.4.56.1, 3.8.3-150600.4.17.1
gnutls28 (Debian package) - addressed in versions 3.7.9-2+deb12u6, 3.8.9-3+deb13u2
gnutls-doc - update to 3.8.2-5
gnutls-help - update to 3.8.2-11
gnutls-utils - update to 3.8.2-11
gnutls-devel - update to 3.8.2-11
gnutls-debugsource - update to 3.8.2-11
gnutls-debuginfo - update to 3.8.2-11
gnutls-dane - update to 3.8.2-11
gnutls - update to 3.8.2-11
libgnutlsxx30-debuginfo - update to 3.8.3-150600.4.17.1
libgnutlsxx30 - update to 3.8.3-150600.4.17.1
gnutls - addressed in versions 3.8.11-3.fc42, 3.8.12-1.fc43
libtasn1 (Red Hat package) - addressed in versions 4.13-3.el8_4.1, 4.13-3.el8_6.2

External References

Related Security Bulletins