Logo
›
›vulnerability›CVE-2025-14831
Name
CVE-2025-14831
Source
NVD ( link)Debian ( link)
Description
A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).
CWEs
CWE-407
Published Date
Updated Date
Workaround
-
Advisories

Analysis#

Affected Component
Analysis
gnutls
Patched

Vulnerability Ratings#

5.3
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
gnutls
buildroot
2025.02.x
3.8.13
Not Affected
gnutls
buildroot
master
3.8.13
Not Affected
gnutls
openwrt
master
3.8.10-r1
Not Affected
gnutls
openwrt
openwrt-25.12
3.8.10-r1
Not Affected
gnutls
yocto
kirkstone
3.7.4
Not Affected
gnutls
yocto
master
3.8.13
Not Affected

Resolved with patches#

gnutls (yocto:scarthgap)

#
Title
Author
Resolve
1
x509/name_constraints: name_constraints_node_list_intersect
Alexander Sosedkin <asosedkin@redhat.com>
CVE-2025-14831
2
tests/name-constraints-ip: stop swallowing errors...
Alexander Sosedkin <asosedkin@redhat.com>
CVE-2025-14831
3
x509/name_constraints: name_constraints_node_add_{new,copy}
Alexander Sosedkin <asosedkin@redhat.com>
CVE-2025-14831
4
x509/name_constraints: make types_with_empty_intersection a
Alexander Sosedkin <asosedkin@redhat.com>
CVE-2025-14831
5
x509/name_constraints: reject some malformed domain names
Alexander Sosedkin <asosedkin@redhat.com>
CVE-2025-14831
6
x509/name_constraints: add sorted_view in preparation...
Alexander Sosedkin <asosedkin@redhat.com>
CVE-2025-14831
7
x509/name_constraints: use actual zeroes in universal exclude
Alexander Sosedkin <asosedkin@redhat.com>
CVE-2025-14831
8
x509/name_constraints: implement
Alexander Sosedkin <asosedkin@redhat.com>
CVE-2025-14831
9
x509/name_constraints: introduce a rich comparator
Alexander Sosedkin <asosedkin@redhat.com>
CVE-2025-14831