Priority CRITICAL 91
The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.87264 · Published 2009-11-09 · Fixed in 7.0.10, 6.0.32 +1 CWE-300
Priority HIGH 72
A flaw was found in gnutls.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.00565 · Published 2026-04-30 · Partial fix · 3.8.13, 3.8.10-4.el10_2 +42 CWE-178
Priority HIGH 72
A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01392 · Published 2024-01-16 · Partial fix · 3.8.3, 3.7.6-23.el9_3.3 +36 CWE-347
Priority HIGH 68
A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.01453 · Published 2023-02-15 · Partial fix CWE-203
Priority HIGH 67
A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.59237 · Published 2019-03-27 · Fixed CWE-416
Priority HIGH 67
Double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via crafted policy language information in an X.509…
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.32754 · Published 2017-03-24 · Fixed CWE-415
Priority MEDIUM 57
The _gnutls_server_name_recv_params function in lib/ext_server_name.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 does not properly calculate the number of Server Names in a TLS 1.0 Client Hello message during ext…
CVSS 2.0HIGH 10.0· Network · No auth · Interaction — · EPSS 0.12018 · Published 2008-05-21 · Fixed CWE-189
Priority MEDIUM 55
A flaw was found in gnutls.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03377 · Published 2021-03-12 · Fixed CWE-416
Priority MEDIUM 52
GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3).
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.22455 · Published 2020-06-04 · Fixed CWE-327
Priority MEDIUM 52
Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.07071 · Published 2017-03-24 · Partial fix CWE-119
Priority MEDIUM 51
A flaw was found in gnutls.
CVSS 3.1LOW 3.7· Network · No auth · No interaction · EPSS 0.00804 · Published 2026-04-30 · Partial fix · 3.8.13, 3.8.10-4.el10_2 +22 CWE-179
Priority MEDIUM 51
Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.06179 · Published 2017-03-24 · Partial fix CWE-119
Priority MEDIUM 49
A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.02073 · Published 2026-04-30 · Partial fix · 3.8.13, 3.8.10-4.el10_2 +45 CWE-191
Priority MEDIUM 49
lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers…
CVSS 2.0MEDIUM 5.8· Network · No auth · Interaction — · EPSS 0.2986 · Published 2014-03-06 · Partial fix CWE-310
Priority MEDIUM 49
The _gnutls_recv_client_kx_message function in lib/gnutls_kx.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 continues to process Client Hello messages within a TLS message after one has already been processed, whic…
CVSS 2.0HIGH 9.3· Network · No auth · Interaction — · EPSS 0.05772 · Published 2008-05-21 · Fixed CWE-287
Priority MEDIUM 48
A flaw was found in gnutls.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03678 · Published 2021-03-12 · Fixed CWE-416
Priority MEDIUM 44
A flaw was found in gnutls.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0105 · Published 2026-05-07 · Partial fix · 3.8.13, 3.8.10-4.el10_2 +47 CWE-170
Priority MEDIUM 44
The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service (out-of-memory error and crash) via a crafted OpenPGP certifica…
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.08009 · Published 2017-03-24 · Partial fix CWE-125
Priority MEDIUM 43
A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility.
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.00896 · Published 2025-07-10 · Partial fix · 3.8.10, 3.8.9-9.el10_0.14 +8 CWE-122
Priority MEDIUM 43
A vulnerability found in gnutls.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02269 · Published 2022-08-01 · Partial fix CWE-415
Priority MEDIUM 43
Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.15, and 3.3.x before 3.3.4 allows remote servers to cause a denial of service (memory corruption) or p…
CVSS 2.0MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.11221 · Published 2014-06-03 · Partial fix CWE-119
Priority MEDIUM 42
A flaw was found in gnutls.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01335 · Published 2026-05-18 · Partial fix · 3.8.13, 3.8.10-4.el10_2 +48 CWE-475
Priority MEDIUM 42
A flaw was found in gnutls.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01374 · Published 2026-04-09 · Fixed in 3.8.12-1.1.hum1 CWE-476
Priority MEDIUM 42
A vulnerability was found in GnuTLS.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01614 · Published 2024-01-16 · Partial fix · 3.8.3, 3.6.16-8.el8_9.1 +39 CWE-203
Priority MEDIUM 42
Use-after-free vulnerability in the _gnutls_handshake_hash_buffers_clear function in lib/gnutls_handshake.c in libgnutls in GnuTLS 2.3.5 through 2.4.0 allows remote attackers to cause a denial of service (crash) or possi…
CVSS 2.0HIGH 7.6· Network · No auth · Interaction — · EPSS 0.05457 · Published 2008-08-08 · No fix listed CWE-119
Load more
THREATIST.IORead the docs