PT-2025-29040 · Gnutls+10 · Gnutls+10
Published
2025-07-10
·
Updated
2026-03-29
·
CVE-2025-32988
CVSS v2.0
8.5
High
| Vector | AV:N/AC:L/Au:N/C:N/I:P/A:C |
Name of the Vulnerable Software and Affected Versions
GnuTLS versions prior to 3.7.9-2+deb12u5
GnuTLS versions prior to 3.8.10-alt1
GnuTLS versions prior to 3.6.16-alt8
Description
The GnuTLS library contains a flaw due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, the
asn1 delete structure() function is called on an ASN.1 node that GnuTLS does not own, leading to a double-free condition when the parent function or caller attempts to free the same structure. This issue can be triggered using public GnuTLS APIs and may result in a denial of service or memory corruption, depending on the allocator behavior.Recommendations
Upgrade to GnuTLS version 3.7.9-2+deb12u5 or later.
Upgrade to GnuTLS version 3.8.10-alt1 or later.
Upgrade to GnuTLS version 3.6.16-alt8 or later.
Fix
DoS
Double Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Debian
Gnutls
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu