The vulnerability lies in Mod_gnutls’s processing of client certificate chains. Prior to version 0.12.3 and 0.13.0 the verification routine copied the chain into a fixed-size array of gnutls_x509_crt_t pointers without validating that the number of certificates did not exceed the buffer bounds. This can overwrite memory adjacent to the array, leading to a crash or, in theory, corrupting the stack. The bug does not allow attackers to write arbitrary data into the buffer, but the result is a denial‑of‑service and a potential remote stack corruption attack vector.

Affected installations of airtower‑luna’s Mod_gnutls TLS module for Apache HTTPD are vulnerable in versions older than 0.12.3 and older than 0.13.0. Servers that do not enable client certificate verification (the default configuration) are not impacted.

The CVSS score is 7.5, reflecting high severity. An EPSS score of less than 1 % indicates low current exploitation probability, and it is not listed in the CISA KEV catalog. Exploitation requires a client to present an excessively long certificate chain, so the attack vector is remote from a client. No workaround exists; the only mitigation is to upgrade to a fixed version.