CVE-2025-32989: GnuTLS heap buffer overread in SCT extension parsing

CVE-2025-32989 · Severity: medium · CVSS 5.3 · Published 2025-07-10

GnuTLS, a widely used security library for encrypting internet communications, contains a vulnerability in how it processes certain website security certificates. An attacker can provide a specially crafted certificate that causes the library to read beyond its intended memory boundaries. This could allow an attacker to potentially access sensitive information from the memory of applications using the library, such as web browsers or secure servers.

Technologies: Gnutls, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9. Vendors: Gnu, Red Hat.

Quick answers

Is CVE-2025-32989 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-32989 being exploited in the wild.
How severe is CVE-2025-32989?
Medium severity, with a CVSS score of 5.3, published 10 July 2025.
Which products and versions are affected?
Gnutls All versions prior to fix; Red Hat Enterprise Linux 10 < 3.8.9-9.el10_0.14; Red Hat Enterprise Linux 9 < 3.8.3-6.el9_6.2.
Is there a fix for CVE-2025-32989?
A patch was published on 2025-07-08: GnuTLS 3.8.10 released fixing the issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-32989 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-32989?
Check whether you run Gnutls, Red Hat Enterprise Linux 10 or Red Hat Enterprise Linux 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-buffer-overread vulnerability exists in GnuTLS within the handling of the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension (OID 1.3.6.1.4.1.11129.2.4.2) during X.509 certificate parsing. The flaw is triggered when GnuTLS verifies a certificate containing a malformed SCT extension that is not correctly validated. An unauthenticated remote attacker can exploit this by presenting a malicious certificate to a client or server using GnuTLS, potentially resulting in the disclosure of sensitive data from the process memory. The issue is addressed in GnuTLS version 3.8.10 and various vendor-specific patches.

Affected products

  • GnuTLS Project GnuTLS < 3.8.10
  • Red Hat Enterprise Linux 9 < 3.8.3-6.el9_6.2
  • Red Hat Enterprise Linux 10 < 3.8.9-9.el10_0.14

Timeline

  • 2025-07-08: patched: GnuTLS 3.8.10 released fixing the issue.
  • 2025-07-10: disclosed: Initial CVE publication.
  • 2025-09-17: advisory: Red Hat published security advisories RHSA-2025:16115 and RHSA-2025:16116.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.