A heap‑buffer‑overflow (off‑by‑one) flaw exists in the certtool utility of GnuTLS during template parsing. When certtool reads specific settings from a template file, it writes a NULL pointer one byte beyond a heap buffer, corrupting memory and causing a denial‑of‑service by crashing the process or the host. The weakness is categorized as CWE‑122.

The vulnerability affects Red Hat–supported products that depend on GnuTLS, such as Ceph Storage 7, Discovery 2, Enterprise Linux 6–8 and 9 (including 9.2 and 9.4 Extended Update Support), Hardened Images, Insights Proxy 1.5, and OpenShift Container Platform 4. Any system that runs gnutls certtool and processes template files is susceptible.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. It is not included in CISA’s KEV catalog. Based on the description, the likely attack vector is local or requires privileged access to supply a malicious template file; remote exploitation would need the attacker to gain such access or otherwise influence certtool’s input. While rare, the impact is a system crash, making the vulnerability actionable.