Junglewise Threat Intelligence

CVE-2025-32989: GnuTLS heap buffer overread in SCT extension parsing

CVE-2025-32989 · Severity: medium · CVSS 5.3 · Published 2025-07-10

Technologies: Red Hat Enterprise Linux 10, GnuTLS Project Gnutls, Red Hat Enterprise Linux 9. Vendors: Red Hat, Gnu.

Executive brief

GnuTLS, a widely used security library for encrypting internet communications, contains a vulnerability in how it processes certain website security certificates. An attacker can provide a specially crafted certificate that causes the library to read beyond its intended memory boundaries. This could allow an attacker to potentially access sensitive information from the memory of applications using the library, such as web browsers or secure servers.

Technical details

A heap-buffer-overread vulnerability exists in GnuTLS within the handling of the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension (OID 1.3.6.1.4.1.11129.2.4.2) during X.509 certificate parsing. The flaw is triggered when GnuTLS verifies a certificate containing a malformed SCT extension that is not correctly validated. An unauthenticated remote attacker can exploit this by presenting a malicious certificate to a client or server using GnuTLS, potentially resulting in the disclosure of sensitive data from the process memory. The issue is addressed in GnuTLS version 3.8.10 and various vendor-specific patches.

Affected products

  • GnuTLS Project GnuTLS < 3.8.10
  • Red Hat Enterprise Linux 9 < 3.8.3-6.el9_6.2
  • Red Hat Enterprise Linux 10 < 3.8.9-9.el10_0.14

Timeline

  • 2025-07-08: patched: GnuTLS 3.8.10 released fixing the issue.
  • 2025-07-10: disclosed: Initial CVE publication.
  • 2025-09-17: advisory: Red Hat published security advisories RHSA-2025:16115 and RHSA-2025:16116.

References

Related threats