gnutls-utils (AlmaLinux:8) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the AlmaLinux:8 package gnutls-utils, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (20)

• CVE-2021-20232 — CVSS 9.8 (critical): A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may lead to memory corruption and…
• CVE-2021-20231 — CVSS 9.8 (critical): A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to memory corruption and other…
• CVE-2021-3580 — CVSS 7.5 (high): A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to…
• CVE-2022-2509 — CVSS 7.5 (high): A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during verification of pkcs7 signatures…
• CVE-2024-0553 — CVSS 7.5 (high): A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response…
• CVE-2026-33846 — CVSS 7.5 (high): A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in…
• CVE-2026-42009 — CVSS 7.5 (high): A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering…
• CVE-2026-33845 — CVSS 7.5 (high): A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow…
• CVE-2026-42011 — CVSS 7.4 (high): A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate…
• CVE-2023-0361 — CVSS 7.4 (high): A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to…
• CVE-2026-42010 — CVSS 7.1 (high): A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames…
• CVE-2026-3833 — CVSS 6.5 (medium): A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels…
• CVE-2025-32990 — CVSS 6.5 (medium): A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When…
• CVE-2025-6395 — CVSS 6.5 (medium): A NULL pointer dereference flaw was found in the GnuTLS software in _gnutls_figure_common_ciphersuite().
• CVE-2025-32988 — CVSS 6.5 (medium): A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject…
• CVE-2023-5981 — CVSS 5.9 (medium): A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of…
• CVE-2024-28834 — CVSS 5.3 (medium): A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like…
• CVE-2024-12243 — CVSS 5.3 (medium): A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding…
• CVE-2025-14831 — CVSS 5.3 (medium): A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory…
• CVE-2025-9820 — CVSS 4.0 (medium): A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization…