CVE-2025-32988

EUVD-2025-20928

10.07.2025, 08:15

A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1_delete_structure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function or caller later attempts to free the same structure.

This vulnerability can be triggered using only public GnuTLS APIs and may result in denial of service or memory corruption, depending on allocator behavior.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.5 MEDIUM	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 45%

Affected Products (NVD)

Vendor	Product	Version
gnu	gnutls	𝑥 < 3.8.10
redhat	openshift_container_platform	4.0
redhat	enterprise_linux	6.0
redhat	enterprise_linux	7.0
redhat	enterprise_linux	8.0
redhat	enterprise_linux	9.0
redhat	enterprise_linux	10.0

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
Siemens	SIMATIC S7-1500 CPU 1518-4 PN\/DP MFP	V3.1.5 ≤ 𝑥 < *	ADP
Siemens	SIMATIC S7-1500 CPU 1518-4 PN\/DP MFP	V3.1.5 ≤ 𝑥 < *	ADP
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN\/DP MFP	V3.1.5 ≤ 𝑥 < *	ADP
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN\/DP MFP	V3.1.5 ≤ 𝑥 < *	ADP
Siemens	SIPLUS S7-1500 CPU 1518-4 PN\/DP MFP	V3.1.5 ≤ 𝑥 < *	ADP

Debian Releases

Debian Product

Codename

gnutls28

bookworm	3.7.9-2+deb12u6 fixed
bookworm (security)	3.7.9-2+deb12u7 fixed
bullseye	vulnerable
bullseye (security)	3.7.1-5+deb11u10 fixed
forky	3.8.13-1 fixed
sid	3.8.13-1 fixed
trixie	3.8.9-3+deb13u3 fixed
trixie (security)	3.8.9-3+deb13u4 fixed

Ubuntu Releases

Ubuntu Product

Codename

gnutls28

bionic	Fixed 3.5.18-1ubuntu1.6+esm2 released
focal	Fixed 3.6.13-2ubuntu1.12+esm1 released
jammy	Fixed 3.7.3-4ubuntu1.7 released
noble	Fixed 3.8.3-1.1ubuntu3.4 released
oracular	ignored
plucky	Fixed 3.8.9-2ubuntu3.1 released
questing	Fixed 3.8.9-3ubuntu1 released
resolute	Fixed 3.8.9-3ubuntu1 released
xenial	not-affected

openSUSE / SLES Releases

openSUSE Product

Release

gnutls

suse enterprise desktop 15 SP6	3.8.3-150600.4.9.1 fixed
suse enterprise desktop 15 SP7	3.8.3-150600.4.9.1 fixed
suse enterprise sap 15 SP6	3.8.3-150600.4.9.1 fixed
suse enterprise sap 15 SP7	3.8.3-150600.4.9.1 fixed
suse enterprise server 15 SP2	3.6.7-150200.14.37.1 fixed
suse enterprise server 15 SP3	3.6.7-150200.14.37.1 fixed
suse enterprise server 15 SP4	3.7.3-150400.4.50.1 fixed
suse enterprise server 15 SP5	3.7.3-150400.4.50.1 fixed
suse enterprise server 15 SP6	3.8.3-150600.4.9.1 fixed
suse enterprise server 15 SP7	3.8.3-150600.4.9.1 fixed

gnutls-guile

suse enterprise server 15 SP5

3.7.3-150400.4.50.1

fixed

libgnutls-devel

suse enterprise desktop 15 SP6	3.8.3-150600.4.9.1 fixed
suse enterprise desktop 15 SP7	3.8.3-150600.4.9.1 fixed
suse enterprise sap 15 SP6	3.8.3-150600.4.9.1 fixed
suse enterprise sap 15 SP7	3.8.3-150600.4.9.1 fixed
suse enterprise server 15 SP2	3.6.7-150200.14.37.1 fixed
suse enterprise server 15 SP3	3.6.7-150200.14.37.1 fixed
suse enterprise server 15 SP4	3.7.3-150400.4.50.1 fixed
suse enterprise server 15 SP5	3.7.3-150400.4.50.1 fixed
suse enterprise server 15 SP6	3.8.3-150600.4.9.1 fixed
suse enterprise server 15 SP7	3.8.3-150600.4.9.1 fixed

libgnutls-devel-32bit

suse enterprise server 15 SP3

3.6.7-150200.14.37.1

fixed

libgnutls30

suse enterprise desktop 15 SP6	3.8.3-150600.4.9.1 fixed
suse enterprise desktop 15 SP7	3.8.3-150600.4.9.1 fixed
suse enterprise sap 15 SP6	3.8.3-150600.4.9.1 fixed
suse enterprise sap 15 SP7	3.8.3-150600.4.9.1 fixed
suse enterprise server 15 SP2	3.6.7-150200.14.37.1 fixed
suse enterprise server 15 SP3	3.6.7-150200.14.37.1 fixed
suse enterprise server 15 SP4	3.7.3-150400.4.50.1 fixed
suse enterprise server 15 SP5	3.7.3-150400.4.50.1 fixed
suse enterprise server 15 SP6	3.8.3-150600.4.9.1 fixed
suse enterprise server 15 SP7	3.8.3-150600.4.9.1 fixed

libgnutls30-32bit

suse enterprise desktop 15 SP6	3.8.3-150600.4.9.1 fixed
suse enterprise desktop 15 SP7	3.8.3-150600.4.9.1 fixed
suse enterprise sap 15 SP6	3.8.3-150600.4.9.1 fixed
suse enterprise sap 15 SP7	3.8.3-150600.4.9.1 fixed
suse enterprise server 15 SP2	3.6.7-150200.14.37.1 fixed
suse enterprise server 15 SP3	3.6.7-150200.14.37.1 fixed
suse enterprise server 15 SP4	3.7.3-150400.4.50.1 fixed
suse enterprise server 15 SP5	3.7.3-150400.4.50.1 fixed
suse enterprise server 15 SP6	3.8.3-150600.4.9.1 fixed
suse enterprise server 15 SP7	3.8.3-150600.4.9.1 fixed

libgnutls30-hmac

suse enterprise server 15 SP2	3.6.7-150200.14.37.1 fixed
suse enterprise server 15 SP3	3.6.7-150200.14.37.1 fixed
suse enterprise server 15 SP4	3.7.3-150400.4.50.1 fixed
suse enterprise server 15 SP5	3.7.3-150400.4.50.1 fixed

libgnutls30-hmac-32bit

suse enterprise server 15 SP2	3.6.7-150200.14.37.1 fixed
suse enterprise server 15 SP3	3.6.7-150200.14.37.1 fixed
suse enterprise server 15 SP4	3.7.3-150400.4.50.1 fixed
suse enterprise server 15 SP5	3.7.3-150400.4.50.1 fixed

libgnutlsxx-devel

suse enterprise desktop 15 SP6	3.8.3-150600.4.9.1 fixed
suse enterprise desktop 15 SP7	3.8.3-150600.4.9.1 fixed
suse enterprise sap 15 SP6	3.8.3-150600.4.9.1 fixed
suse enterprise sap 15 SP7	3.8.3-150600.4.9.1 fixed
suse enterprise server 15 SP2	3.6.7-150200.14.37.1 fixed
suse enterprise server 15 SP3	3.6.7-150200.14.37.1 fixed
suse enterprise server 15 SP4	3.7.3-150400.4.50.1 fixed
suse enterprise server 15 SP5	3.7.3-150400.4.50.1 fixed
suse enterprise server 15 SP6	3.8.3-150600.4.9.1 fixed
suse enterprise server 15 SP7	3.8.3-150600.4.9.1 fixed

libgnutlsxx28

suse enterprise server 15 SP2	3.6.7-150200.14.37.1 fixed
suse enterprise server 15 SP3	3.6.7-150200.14.37.1 fixed
suse enterprise server 15 SP4	3.7.3-150400.4.50.1 fixed
suse enterprise server 15 SP5	3.7.3-150400.4.50.1 fixed

libgnutlsxx30

suse enterprise desktop 15 SP6	3.8.3-150600.4.9.1 fixed
suse enterprise desktop 15 SP7	3.8.3-150600.4.9.1 fixed
suse enterprise sap 15 SP6	3.8.3-150600.4.9.1 fixed
suse enterprise sap 15 SP7	3.8.3-150600.4.9.1 fixed
suse enterprise server 15 SP6	3.8.3-150600.4.9.1 fixed
suse enterprise server 15 SP7	3.8.3-150600.4.9.1 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

gnutls

RHEL 8	0:3.6.16-8.el8_10.4 fixed
RHEL 9	0:3.8.3-6.el9_6.2 fixed

gnutls-c

RHEL 8	0:3.6.16-8.el8_10.4 fixed
RHEL 9	0:3.8.3-6.el9_6.2 fixed

gnutls-dane

RHEL 8	0:3.6.16-8.el8_10.4 fixed
RHEL 9	0:3.8.3-6.el9_6.2 fixed

gnutls-devel

RHEL 8	0:3.6.16-8.el8_10.4 fixed
RHEL 9	0:3.8.3-6.el9_6.2 fixed

gnutls-utils

RHEL 8	0:3.6.16-8.el8_10.4 fixed
RHEL 9	0:3.8.3-6.el9_6.2 fixed

Common Weakness Enumeration

CWE-415 - Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

References

https://access.redhat.com/errata/RHSA-2025:16115

https://access.redhat.com/errata/RHSA-2025:16116

https://access.redhat.com/errata/RHSA-2025:17181

https://access.redhat.com/errata/RHSA-2025:17348

https://access.redhat.com/errata/RHSA-2025:17361

https://access.redhat.com/errata/RHSA-2025:17415

https://access.redhat.com/errata/RHSA-2025:19088

https://access.redhat.com/errata/RHSA-2025:22529

https://access.redhat.com/errata/RHSA-2026:7477

https://access.redhat.com/security/cve/CVE-2025-32988

https://bugzilla.redhat.com/show_bug.cgi?id=2359622

https://lists.gnupg.org/pipermail/gnutls-help/2025-July/004883.html

http://www.openwall.com/lists/oss-security/2025/07/11/3

https://lists.debian.org/debian-lts-announce/2025/08/msg00005.html

https://cert-portal.siemens.com/productcert/html/ssa-082556.html