Back Linuxsecurity

Fedora 43 GnuTLS Addresses Critical Denial of Service Vulnerability Fix

Linuxsecurity •LinuxSecurity Advisories • February 12, 2026

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and other required structures. Update Information : This fixes a couple CVEs: ** libgnutls: Fix NULL pointer dereference in PSK binder verification A TLS 1.3 resumption attempt with an invalid PSK binder value in ClientHello could lead to a denial of service attack via crashing the server. The updated code guards against the problematic dereference. Reported by Jaehun Lee. [Fixes: GNUTLS- SA-2026-02-09-1, CVSS: high] [CVE-2026-1584] ** libgnutls: Fix name constraint processing performance issue Verifying certificates with pathological amounts of name constraints could lead to a denial of service attack via resource exhaustion. Reworked processing algorithms exhibit better performance characteristics. Reported by Tim Scheckenbach. [Fixes: GNUTLS-SA-2026-02-09-2, CVSS: medium] [CVE-2025-14831]

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS

protocols and technologies around them. It provides a simple C language

application programming interface (API) to access the secure communications

protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and

other required structures.

This fixes a couple CVEs: ** libgnutls: Fix NULL pointer dereference in PSK binder verification A TLS 1.3 resumption attempt with an invalid PSK binder value in ClientHello could lead to a denial of service attack via crashing the server. The updated code guards against the problematic dereference. Reported by Jaehun Lee. [Fixes: GNUTLS- SA-2026-02-09-1, CVSS: high] [CVE-2026-1584] ** libgnutls: Fix name constraint processing performance issue Verifying certificates with pathological amounts of name constraints could lead to a denial of service attack via resource exhaustion. Reworked processing algorithms exhibit better performance characteristics. Reported by Tim Scheckenbach. [Fixes: GNUTLS-SA-2026-02-09-2, CVSS: medium] [CVE-2025-14831]

* Tue Feb 10 2026 Alexander Sosedkin - 3.8.12-1 - Update to 3.8.12 upstream release - Resolves: rhbz#2438001

[ 1 ] Bug #2437987 - CVE-2025-14831 gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification [fedora-43] [ 2 ] Bug #2437989 - CVE-2026-1584 gnutls: gnutls: Remote Denial of Service via crafted ClientHello with invalid PSK binder [fedora-43]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-ef7170c9f6' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical GnuTLS Vulnerabilities Addressed in Fedora 43 Updates Fedora 43 has released critical updates for GnuTLS, addressing vulnerabilities CVE-2025-9820 and CVE-2025-14831. The updates include fixes for a NULL pointer dereference issue and enhancements to the secure communications library, which affects applications relying on GnuTLS for SSL and TLS protocols. 10 sources 39

Extracted Entities

Fedora 43 GnuTLS Addresses Critical Denial of Service Vulnerability Fix

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (2)

MITRE ATT&CK (1)

Platforms (1)