Description
The "record packet parsing" in GnuTLS 1.2 before 1.2.3 and 1.0 before 1.0.25 allows remote attackers to cause a denial of service, possibly related to padding bytes in gnutils_cipher.c.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | gnutls +1 | 1.0.20-3.2.1 | RHSA-2005:430 |
Advisories 1
- RHSA-2005:430 Red Hat Security Advisory: gnutls security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 15193 third-party-advisory
- RHSA-2005:430 vendor-advisory
- 16054 vdb-entry
- 13477 vdb-entry
- gnutls-record-parsing-dos(20328) vdb-entry
- oval:org.mitre.oval:def:9238 vdb-entry signature
- [gnutls-dev] 20050428 GnuTLS 1.2.3 and 1.0.25 mailing-list
- 1013861 vdb-entry