# CVE-2024-12133: GNU libtasn1 denial of service via inefficient DER decoding

Source: https://junglewise.ai/threats/cve-2024-12133-gnu-libtasn1-denial-of-service-via-inefficient-der-decoding  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-02-10. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2024-12133 · Severity: medium · CVSS 5.3 · Published 2025-02-10

A vulnerability in the libtasn1 library, which is used to process digital certificates and security structures, can allow an attacker to crash or significantly slow down a system. By sending a specially crafted certificate with a large number of elements, an attacker can force the system to spend excessive time processing the data. This results in a denial-of-service, potentially disrupting secure communications or services that rely on certificate validation.

Technologies: [Debian](https://junglewise.ai/threats/technologies/debian). Vendors: [Debian](https://junglewise.ai/threats/vendors/debian), [Gnu](https://junglewise.ai/threats/vendors/gnu).

## Quick answers

**Is CVE-2024-12133 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-12133 being exploited in the wild.

**How severe is CVE-2024-12133?** Medium severity, with a CVSS score of 5.3, published 10 February 2025.

**Which products and versions are affected?** Gnu Libtasn1 4.13, 4.16.0.

**Is there a fix for CVE-2024-12133?** A patch was published on 2025-04-22: Red Hat Enterprise Linux 8 patch released (RHSA-2025:4049) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-12133 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-12133?** Check whether you run Debian or Gnu Libtasn1 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability classified as Inefficient Algorithmic Complexity (CWE-407) exists in libtasn1 during the decoding of Distinguished Encoding Rules (DER) data. The root cause is the inefficient handling of specific certificate structures containing a large number of elements, which leads to exponential or high-order polynomial processing time. A remote, unauthenticated attacker can exploit this by providing a specially crafted ASN.1/DER encoded certificate to an application using the library. Successful exploitation results in excessive CPU consumption, leading to a denial-of-service (DoS) condition. Patches have been released by Red Hat, Debian, and the upstream GnuTLS/libtasn1 project.

## Affected products

- GNU libtasn1 4.13, 4.16.0
- Red Hat Enterprise Linux 8, 9.2
- Debian Debian LTS

## Timeline

- 2025-02-06: disclosed: Initial disclosure on oss-security mailing list
- 2025-02-10: advisory: NVD publication and Red Hat initial CVE assignment
- 2025-04-22: patched: Red Hat Enterprise Linux 8 patch released (RHSA-2025:4049)
- 2025-10-06: patched: Red Hat Enterprise Linux 9.2 patch released (RHSA-2025:17347)

## References

- [https://access.redhat.com/errata/RHSA-2025:17347](https://access.redhat.com/errata/RHSA-2025:17347)
- [https://access.redhat.com/errata/RHSA-2025:4049](https://access.redhat.com/errata/RHSA-2025:4049)
- [https://access.redhat.com/errata/RHSA-2025:7077](https://access.redhat.com/errata/RHSA-2025:7077)
- [https://access.redhat.com/errata/RHSA-2025:8021](https://access.redhat.com/errata/RHSA-2025:8021)
- [https://access.redhat.com/errata/RHSA-2025:8385](https://access.redhat.com/errata/RHSA-2025:8385)
- [https://access.redhat.com/security/cve/CVE-2024-12133](https://access.redhat.com/security/cve/CVE-2024-12133)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2344611](https://bugzilla.redhat.com/show_bug.cgi?id=2344611)