CVE-2025-9820: Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function

Severity: medium (CVSS 4.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-26 · updated 2026-10-14
Weakness: CWE-121

Description

A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.

Affected products

Red Hat Cert Manager support for Red Hat OpenShift release 1.18: all versions — fixed in 1789029076, 1791459707, 1791459711, 1791459759, 1791966259
Red Hat OpenShift Container Platform 4.18: all versions
Red Hat Ceph Storage 8: all versions — fixed in 1774002867
Red Hat Discovery 2: all versions — fixed in 1775668717, 1775675922
Red Hat Enterprise Linux 10: all versions — fixed in 0:3.8.10-3.el10_1
Red Hat Enterprise Linux 6: all versions
Red Hat Enterprise Linux 7: all versions
Red Hat Enterprise Linux 8: all versions — fixed in 0:3.6.16-8.el8_10.5
Red Hat Enterprise Linux 9: all versions — fixed in 0:3.8.3-10.el9_7
Red Hat Hardened Images: all versions — fixed in 3.8.12-1.1.hum1
Red Hat Insights proxy 1.5: all versions — fixed in 1773685509
Red Hat Update Infrastructure 5: all versions — fixed in 1773668803, 1773670073, 1773670137, 1773672059
Red Hat RHEL-8 based Middleware Containers: all versions — fixed in 7.13.5-3.1777325680, 7.13.5-4.1777325677, 7.13.5-4.1777325680, 7.13.5-4.1777325708, 7.13.5-4.1777325709, 7.13.5-4.1777325710

How to fix

Upgrade to a fixed version: Red Hat Cert Manager support for Red Hat OpenShift release 1.18 1789029076, 1791459707, 1791459711, 1791459759; Red Hat Ceph Storage 8 1774002867; Red Hat Discovery 2 1775668717, 1775675922; Red Hat Enterprise Linux 10 0:3.8.10-3.el10_1; Red Hat Enterprise Linux 8 0:3.6.16-8.el8_10.5; Red Hat Enterprise Linux 9 0:3.8.3-10.el9_7; Red Hat Hardened Images 3.8.12-1.1.hum1; Red Hat Insights proxy 1.5 1773685509; Red Hat Update Infrastructure 5 1773668803, 1773670073, 1773670137, 1773672059; Red Hat RHEL-8 based Middleware Containers 7.13.5-3.1777325680, 7.13.5-4.1777325677, 7.13.5-4.1777325680, 7.13.5-4.1777325708. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-9820 or the next vulnerability affects your stack