# CVE-2024-12243: GnuTLS denial of service via inefficient DER decoding in libtasn1

Source: https://junglewise.ai/threats/cve-2024-12243-gnutls-denial-of-service-via-inefficient-der-decoding-in-libtasn1  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-02-10. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2024-12243 · Severity: medium · CVSS 5.3 · Published 2025-02-10

A performance flaw was identified in GnuTLS, a widely used security library that enables encrypted communications for many applications and operating systems. By sending a specially crafted digital certificate, a remote attacker can force the system to spend an excessive amount of time processing the data. This can cause the affected service to become slow or completely unresponsive, leading to a denial-of-service for legitimate users.

Technologies: [Red Hat Enterprise Linux 8](https://junglewise.ai/threats/technologies/enterprise-linux-8). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2024-12243 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-12243 being exploited in the wild.

**How severe is CVE-2024-12243?** Medium severity, with a CVSS score of 5.3, published 10 February 2025.

**Which products and versions are affected?** GnuTLS GnuTLS 3.6.x, 3.7.x; GnuTLS libtasn1; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.2.

**Is there a fix for CVE-2024-12243?** A patch was published on 2025-04-22: Red Hat released updates for RHEL 8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-12243 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-12243?** Check whether you run Red Hat Enterprise Linux 8 or Red Hat Enterprise Linux 9.2. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in GnuTLS due to inefficient algorithmic complexity (CWE-407) within the libtasn1 library used for ASN.1 data processing. The root cause is an inefficient algorithm used during the decoding of DER-encoded certificate data. A remote, unauthenticated attacker can exploit this by providing a specially crafted certificate that triggers excessive CPU and memory consumption during the decoding process. This results in a denial-of-service (DoS) condition where the GnuTLS-linked application becomes unresponsive. Patches have been released by various vendors, including Red Hat and Debian, to address the issue in libtasn1 and GnuTLS.

## Affected products

- GnuTLS GnuTLS 3.6.x, 3.7.x
- GnuTLS libtasn1
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9.2

## Timeline

- 2024-12-12: disclosed: Date based on CVE ID assignment year and subsequent reporting
- 2025-02-10: advisory: Initial NVD publication date
- 2025-04-22: patched: Red Hat released updates for RHEL 8
- 2025-10-06: patched: Red Hat released updates for RHEL 9.2

## References

- [https://access.redhat.com/errata/RHSA-2025:17361](https://access.redhat.com/errata/RHSA-2025:17361)
- [https://access.redhat.com/errata/RHSA-2025:4051](https://access.redhat.com/errata/RHSA-2025:4051)
- [https://access.redhat.com/errata/RHSA-2025:7076](https://access.redhat.com/errata/RHSA-2025:7076)
- [https://access.redhat.com/errata/RHSA-2025:8020](https://access.redhat.com/errata/RHSA-2025:8020)
- [https://access.redhat.com/errata/RHSA-2025:8385](https://access.redhat.com/errata/RHSA-2025:8385)
- [https://access.redhat.com/security/cve/CVE-2024-12243](https://access.redhat.com/security/cve/CVE-2024-12243)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2344615](https://bugzilla.redhat.com/show_bug.cgi?id=2344615)

## Related threats

- [Samba AD DC LDAP filter injection and ACL bypass in Compare requests](https://junglewise.ai/threats/cve-2026-58222-samba-ad-dc-ldap-filter-injection-and-acl-bypass-in-compare)
- [Samba KDC out-of-bounds read in kpasswd service](https://junglewise.ai/threats/cve-2026-58216-samba-kdc-out-of-bounds-read-in-kpasswd-service)
- [Samba internal DNS server denial of service via TKEY cache exhaustion](https://junglewise.ai/threats/cve-2026-58218-samba-internal-dns-server-denial-of-service-via-tkey-cache)
- [Red Hat PCP auth bypass in pmproxy /store endpoint](https://junglewise.ai/threats/cve-2026-16527-red-hat-pcp-auth-bypass-in-pmproxy-store-endpoint)
- [Red Hat PCP privilege escalation in linux_sockets PMDA](https://junglewise.ai/threats/cve-2026-16526-red-hat-pcp-privilege-escalation-in-linux-sockets-pmda)