Read the docs
TI-2019-02841 Aliases CVE-2019-3829GHSA-mm54-95hq-f739

Use after free in gnutls

Priority HIGH 67CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-416 and the CVSS impact.

Summary

A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7. A memory corruption (double free) vulnerability in the certificate verification API. Any client or server application that verifies X.509 certificates with GnuTLS 3.5.8 or later is affected.

Why it matters now

EPSS 0.59237 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
GNUgnutlsfixed in 3.6.7; affected from 3.5.8—No fix listedCNA
  • gnutls VendorGNU Affected fixed in 3.6.7; affected from 3.5.8 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:gnu:gnutls:*:*:*:*:*:*:*:*3.5.8 to before 3.6.7VulnerableGNU
cpe:2.3:o:fedoraproject:fedora:-:*:*:*:*:*:*:*not specified by NVDVulnerableFedoraproject
  • cpe:2.3:a:gnu:gnutls:*:*:*:*:*:*:*:* Versions 3.5.8 to before 3.6.7 Vulnerable ·GNU
  • cpe:2.3:o:fedoraproject:fedora:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Fedoraproject

Remediation

Red Hat 1 advisory

  • RHSA-2019:3600 Released 2019-11-05 · Red Hat rating Moderate
    gnutls security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) gnutls-c++-3.6.8-8.el8, gnutls-dane-3.6.8-8.el8, gnutls-devel-3.6.8-8.el8 +1
    • Red Hat Enterprise Linux BaseOS (v. 8) gnutls-3.6.8-8.el8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    gnutls — RHSA-2019:3600

    2 records Highest priority Priority HIGH 1 HIGH, 1 LOW

    Other records, highest priority first

    • TI-2019-02848 It was discovered in gnutls before version 3.6.7 upstream that there is an uninitialized…Priority LOW 39
    Show all 2 records → Advisory →
  • Advisory ·

    gnutls — FEDORA-2019-46df367eed

    2 records Highest priority Priority HIGH 1 HIGH, 1 LOW

    Other records, highest priority first

    • TI-2019-02848 It was discovered in gnutls before version 3.6.7 upstream that there is an uninitialized…Priority LOW 39
    Show all 2 records → Advisory →
Show 1 more group
  • Advisory ·

    gnutls — GLSA-201904-14

    2 records Highest priority Priority HIGH 1 HIGH, 1 LOW

    Other records, highest priority first

    • TI-2019-02848 It was discovered in gnutls before version 3.6.7 upstream that there is an uninitialized…Priority LOW 39
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2019:3600
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2019:3600
Not affected: 4 products
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat OpenShift Enterprise 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-3829
  2. 2026-10-03 Alias added: GHSA-mm54-95hq-f739

References

Exploit 2

Advisory 8

Other 1

  • TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
  • TI-2026-03321 Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison CVSS 3.1HIGH 7.4
  • TI-2024-00525 Gnutls: rejects certificate chain with distributed trust CVSS 3.1HIGH 7.5
  • TI-2023-00345 Observable discrepancy in gnutls CVSS 3.1HIGH 7.4
  • TI-2017-03378 Double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before… CVSS 3.0CRITICAL 9.8
  • TI-2008-01871 The _gnutls_server_name_recv_params function in lib/ext_server_name.c in libgnutls in… CVSS 2.0HIGH 10.0
See all 73 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences