CVE-2025-14831

The vulnerability resides in GnuTLS and permits a denial of service by forcing the library to consume excessive CPU and memory while verifying certificates that contain a very large number of name constraints or subject alternative names. The result is that the TLS handshake stalls or crashes, preventing legitimate connections from succeeding and potentially exhausting system resources.

Affected products include Red Hat AI Inference Server 3.2 and 3.3, Red Hat Ceph Storage 8, Red Hat Discovery 2, several releases of Red Hat Enterprise Linux (6, 7, 8, 9, 10 and related extended update support branches), Red Hat Hardened Images, Red Hat Insights proxy 1.5, Red Hat OpenShift Container Platform 4, and Red Hat Update Infrastructure 5. All of these incorporate the vulnerable GnuTLS library and are susceptible.

The CVSS score of 5.3 places the vulnerability in the medium severity range. The EPSS score is below 1%, indicating a very low probability of exploitation in the wild as of now, and the vulnerability is not listed in CISA's KEV catalog. Nevertheless, an attacker could trigger the denial of service by presenting a malicious certificate during a TLS handshake, a remote path that is typically available to networked clients. The exploit would require the target to load the vulnerable GnuTLS library, which is present in most of the listed Red Hat products.