CVE-2025-14831: Gnutls: gnutls: denial of service via excessive resource consumption during certificate verification

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-09 · updated 2026-10-14
Weakness: CWE-407

Description

A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).

Affected products

Red Hat Cert Manager support for Red Hat OpenShift release 1.18: all versions — fixed in 1789029076, 1791459707, 1791459711, 1791459759, 1791966259
Red Hat OpenShift Container Platform 4.18: all versions
Red Hat AI Inference Server 3.2: all versions — fixed in 1775740563, 1780681984
Red Hat AI Inference Server 3.3: all versions — fixed in 1775680192, 1775680262, 1775749857, 1778244531, 1778244546, 1778244559
Red Hat Ceph Storage 8: all versions — fixed in 1774002867
Red Hat Discovery 2: all versions — fixed in 1775668717, 1775675922
Red Hat Enterprise Linux 10: all versions — fixed in 0:3.8.10-3.el10_1
Red Hat Enterprise Linux 10.0 Extended Update Support: all versions — fixed in 0:3.8.9-9.el10_0.17
Red Hat Enterprise Linux 6: all versions
Red Hat Enterprise Linux 7: all versions
Red Hat Enterprise Linux 8: all versions — fixed in 0:3.6.16-8.el8_10.5
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support: all versions — fixed in 0:3.6.14-10.el8_4.1, 0:4.13-3.el8_4.1
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On: all versions — fixed in 0:3.6.14-10.el8_4.1, 0:4.13-3.el8_4.1
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support: all versions — fixed in 0:3.6.16-5.el8_6.5, 0:4.13-3.el8_6.2
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On: all versions — fixed in 0:3.6.16-5.el8_6.5, 0:4.13-3.el8_6.2
Red Hat Enterprise Linux 8.8 Telecommunications Update Service: all versions — fixed in 0:3.6.16-7.el8_8.4, 0:4.13-4.el8_8.1
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions: all versions — fixed in 0:3.6.16-7.el8_8.4, 0:4.13-4.el8_8.1
Red Hat Enterprise Linux 9: all versions — fixed in 0:3.8.3-10.el9_7
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions: all versions — fixed in 0:3.7.6-21.el9_2.5
Red Hat Enterprise Linux 9.4 Extended Update Support: all versions — fixed in 0:3.8.3-4.el9_4.5
Red Hat Enterprise Linux 9.6 Extended Update Support: all versions — fixed in 0:3.8.3-6.el9_6.3
Red Hat Hardened Images: all versions — fixed in 3.8.12-1.1.hum1
Red Hat Insights proxy 1.5: all versions — fixed in 1773685509
Red Hat Update Infrastructure 5: all versions — fixed in 1773668803, 1773670073, 1773670137, 1773672059
Red Hat RHEL-8 based Middleware Containers: all versions — fixed in 7.13.5-3.1777325680, 7.13.5-4.1777325677, 7.13.5-4.1777325680, 7.13.5-4.1777325708, 7.13.5-4.1777325709, 7.13.5-4.1777325710

How to fix

Upgrade to a fixed version: Red Hat Cert Manager support for Red Hat OpenShift release 1.18 1789029076, 1791459707, 1791459711, 1791459759; Red Hat AI Inference Server 3.2 1775740563, 1780681984; Red Hat AI Inference Server 3.3 1775680192, 1775680262, 1775749857, 1778244531; Red Hat Ceph Storage 8 1774002867; Red Hat Discovery 2 1775668717, 1775675922; Red Hat Enterprise Linux 10 0:3.8.10-3.el10_1; Red Hat Enterprise Linux 10.0 Extended Update Support 0:3.8.9-9.el10_0.17; Red Hat Enterprise Linux 8 0:3.6.16-8.el8_10.5; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:3.6.14-10.el8_4.1, 0:4.13-3.el8_4.1; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 0:3.6.14-10.el8_4.1, 0:4.13-3.el8_4.1; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:3.6.16-5.el8_6.5, 0:4.13-3.el8_6.2; Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 0:3.6.16-5.el8_6.5, 0:4.13-3.el8_6.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-14831 or the next vulnerability affects your stack