CVE-2025-14831: Gnutls: gnutls: denial of service via excessive resource consumption during certificate verification
A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).
Other sources
Verifying Certificates with large amout of name constraints and subject alternative names makes GnuTLS vulnerable to DoS attacks
When trying to verify a certificate chain using the certtool --verify command, with certificates, that contain a larger number of SANs and Name Constraints, GnuTLS tries to verify all of them, without any bound on the quantity of those fields. Using those crafted malicious certificate, GnuTLS is vulnerable to DoS attacks by excessive usage of CPU and memory.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/gnutls28to a version that resolves this vulnerability.Fixed in 3.7.1-5+deb11u10Fixed in 3.7.9-2+deb12u6Fixed in 3.7.9-2+deb12u7Fixed in 3.8.9-3+deb13u3Fixed in 3.8.9-3+deb13u4Fixed in 3.8.13-1 - Upgrade
Upgrade
gnutlsto a version that resolves this vulnerability.Fixed in 3.8.12Patch CVE-2026-1584 & CVE-2025-14831
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14831?
CVE-2025-14831 is classified as a denial of service (DoS) vulnerability due to excessive resource consumption.
How do I fix CVE-2025-14831?
To mitigate CVE-2025-14831, upgrade GnuTLS to version 3.8.12 or later.
What causes the vulnerability CVE-2025-14831?
CVE-2025-14831 is caused by excessive CPU and memory consumption when processing specially crafted malicious certificates.
Which versions of GnuTLS are affected by CVE-2025-14831?
GnuTLS versions up to and including 3.8.12 are affected by CVE-2025-14831.
Is CVE-2025-14831 a widespread vulnerability?
While specific impact may vary, CVE-2025-14831 poses a potential risk to systems using the affected versions of GnuTLS.