A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds (OOB) NULL pointer write, resulting in memory corruption and a denial-of-service (DoS) that could potentially crash the system.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00178.

Exploitation none

Automatable yes

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
unaffected
Version Status Constraints
0 affected < 3.8.10
Red Hat Red Hat Enterprise Linux 10 affected
Version Status Constraints
0:3.8.9-9.el10_0.14 unaffected < *
Red Hat Red Hat Enterprise Linux 8 affected
Version Status Constraints
0:3.6.16-8.el8_10.4 unaffected < *
Red Hat Red Hat Enterprise Linux 8 affected
Version Status Constraints
0:3.6.16-8.el8_10.4 unaffected < *
Red Hat Red Hat Enterprise Linux 9 affected
Version Status Constraints
0:3.8.3-6.el9_6.2 unaffected < *
Red Hat Red Hat Enterprise Linux 9 affected
Version Status Constraints
0:3.8.3-6.el9_6.2 unaffected < *
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions affected
Version Status Constraints
0:3.7.6-21.el9_2.4 unaffected < *
Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support affected
Version Status Constraints
0:3.8.3-4.el9_4.4 unaffected < *
Red Hat Red Hat Ceph Storage 7 affected
Version Status Constraints
sha256:6b79ed10423d954d21dd24c9cb1cf507f6e02c2942ace7fa30cf7af2ffaeb631 unaffected < *
Red Hat Red Hat Discovery 2 affected
Version Status Constraints
sha256:435ba9959b793d46a63a74c343bb8c3ff68350496afec12cc5e894dfc40b7648 unaffected < *
Red Hat Red Hat Insights proxy 1.5 affected
Version Status Constraints
sha256:8eb6b896e1eac4080a564e146f95c4166e47ca137083b37119027c6a77011207 unaffected < *
Red Hat Red Hat Enterprise Linux 6 unknown —
Red Hat Red Hat Enterprise Linux 7 unknown —
Red Hat Red Hat OpenShift Container Platform 4 affected —

Configuration 1 [-]

cpe:2.3:a:gnu:gnutls:-:*:*:*:*:*:*:*

Configuration 2 [-]

OR cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Gnu Subscribe
Gnutls Subscribe
Redhat Subscribe
Ceph Storage Subscribe
Discovery Subscribe
Enterprise Linux Subscribe
Insights Proxy Subscribe
Openshift Subscribe
Openshift Container Platform Subscribe
Rhel E4s Subscribe
Rhel Eus Subscribe
Advisories
Source ID Title
Debian DLA Debian DLA DLA-4267-1 gnutls28 security update
Debian DSA Debian DSA DSA-5962-1 gnutls28 security update
EUVD EUVD EUVD-2025-20990 A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds (OOB) NULL pointer write, resulting in memory corruption and a denial-of-service (DoS) that could potentially crash the system.
Ubuntu USN Ubuntu USN USN-7635-1 GnuTLS vulnerabilities
Ubuntu USN Ubuntu USN USN-7742-1 GnuTLS vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

Currently, no mitigation is available for this vulnerability.

References
Link Providers
http://www.openwall.com/lists/oss-security/2025/07/11/3 cve-icon
https://access.redhat.com/errata/RHSA-2025:16115 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:16116 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:17181 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:17348 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:17361 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:17415 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:19088 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2025:22529 cve-icon cve-icon
https://access.redhat.com/security/cve/CVE-2025-32990 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2359620 cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2025/08/msg00005.html cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-32990 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-32990 cve-icon
History

Mon, 01 Dec 2025 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat ceph Storage
CPEs cpe:/a:redhat:ceph_storage:7::el9
Vendors & Products Redhat ceph Storage
References

Thu, 06 Nov 2025 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat insights Proxy
CPEs cpe:/a:redhat:insights_proxy:1.5::el9
Vendors & Products Redhat insights Proxy
References

Tue, 04 Nov 2025 22:30:00 +0000

Type Values Removed Values Added
References

Mon, 03 Nov 2025 20:30:00 +0000

Type Values Removed Values Added
References

Thu, 23 Oct 2025 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat discovery
CPEs cpe:/a:redhat:discovery:2::el9
Vendors & Products Redhat discovery
References

Wed, 08 Oct 2025 15:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:rhivos:1
Vendors & Products Redhat rhivos

Tue, 07 Oct 2025 12:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:8 cpe:/a:redhat:enterprise_linux:8::appstream
cpe:/o:redhat:enterprise_linux:8::baseos
References

Mon, 06 Oct 2025 11:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel E4s
CPEs cpe:/a:redhat:rhel_e4s:9.2::appstream
cpe:/o:redhat:rhel_e4s:9.2::baseos
Vendors & Products Redhat rhel E4s
References

Mon, 06 Oct 2025 02:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Eus
CPEs cpe:/a:redhat:rhel_eus:9.4::appstream
cpe:/o:redhat:rhel_eus:9.4::baseos
Vendors & Products Redhat rhel Eus
References

Fri, 03 Oct 2025 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhivos
CPEs cpe:/o:redhat:rhivos:1
Vendors & Products Redhat rhivos

Wed, 17 Sep 2025 20:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:9 cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/o:redhat:enterprise_linux:9::baseos
References

Wed, 17 Sep 2025 17:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:10.0
References

Fri, 15 Aug 2025 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Gnu
Gnu gnutls
Redhat openshift Container Platform
CPEs cpe:2.3:a:gnu:gnutls:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Vendors & Products Gnu
Gnu gnutls
Redhat openshift Container Platform

Wed, 16 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00045}

 epss

{'score': 0.00059}

Thu, 10 Jul 2025 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 10 Jul 2025 12:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 10 Jul 2025 09:45:00 +0000

Type Values Removed Values Added
Description A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds (OOB) NULL pointer write, resulting in memory corruption and a denial-of-service (DoS) that could potentially crash the system.
Title Gnutls: vulnerability in gnutls certtool template parsing
First Time appeared Redhat
Redhat enterprise Linux
Redhat openshift
Weaknesses CWE-122
CPEs cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat openshift
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-01-22T00:07:20.320Z

Reserved: 2025-04-15T01:31:12.104Z

Link: CVE-2025-32990

cve-icon Vulnrichment

Updated: 2025-11-04T21:10:08.725Z

cve-icon NVD

Status : Modified

Published: 2025-07-10T10:15:33.060

Modified: 2025-12-01T22:15:48.200

Link: CVE-2025-32990

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-07-09T07:00:00Z

Links: CVE-2025-32990 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses