A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:5585 advisory.

    * gnutls: Stack-based Buffer Overflow in gnutls_pkcs11_token_init() Function (CVE-2025-9820)
      * gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification     (CVE-2025-14831)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-5585 advisory.

    [3.6.16-8.5]
    - Backport the fixes for CVE-2025-9820 and CVE-2025-14831

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:5585 advisory.

    The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements     cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

    Security Fix(es):

    * gnutls: Stack-based Buffer Overflow in gnutls_pkcs11_token_init() Function (CVE-2025-9820)

    * gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification     (CVE-2025-14831)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:4188 advisory.

    * gnutls: Stack-based Buffer Overflow in gnutls_pkcs11_token_init() Function (CVE-2025-9820)
      * gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification     (CVE-2025-14831)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50149 advisory.

    - Fix PKCS#11 token initialization label overflow (CVE-2025-9820)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-4188 advisory.

    - Fix PKCS#11 token initialization label overflow (CVE-2025-9820)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-285:01 advisory.

    * gnutls: Stack-based Buffer Overflow in gnutls_pkcs11_token_init() Function (CVE-2025-9820)
      * gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification     (CVE-2025-14831)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:4188 advisory.

    The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements     cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

    Security Fix(es):

    * gnutls: Stack-based Buffer Overflow in gnutls_pkcs11_token_init() Function (CVE-2025-9820)

    * gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification     (CVE-2025-14831)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:4188 advisory.

    * gnutls: Stack-based Buffer Overflow in gnutls_pkcs11_token_init() Function (CVE-2025-9820)

    * gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification     (CVE-2025-14831)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:0829-1 advisory.

    Security issue:

    - CVE-2025-14831: excessive resource consumption when verifying specially crafted malicious certificates     containing a       large number of name constraints and subject alternative names (bsc#1257960).

    Other updates and bugfixes:

    - update libgnutls package to avoid binder getting calculated with SHA256 (bsc#1258083, jsc#PED-15752,     jsc#PED-15753).
    - lib/psk: Add gnutls_psk_allocate_{client,server}_credentials2
    - tests/psk-file: Add testing for _credentials2 functions
    - lib/psk: add null check for binder algo
    - pre_shared_key: fix memleak when retrying with different binder algo
    - pre_shared_key: add null check on pskcred

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:3477 advisory.

    * gnutls: Stack-based Buffer Overflow in gnutls_pkcs11_token_init() Function (CVE-2025-9820)

    * gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification     (CVE-2025-14831)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-3477 advisory.

    - Fix CVE-2025-9820, CVE-2025-14831, drop unused patches
    - Fix PKCS#11 token initialization label overflow (CVE-2025-9820)
    - Fix name constraint processing performance issue (CVE-2025-14831)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:3477 advisory.

    The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements     cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

    Security Fix(es):

    * gnutls: Stack-based Buffer Overflow in gnutls_pkcs11_token_init() Function (CVE-2025-9820)

    * gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification     (CVE-2025-14831)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:3477 advisory.

    * gnutls: Stack-based Buffer Overflow in gnutls_pkcs11_token_init() Function (CVE-2025-9820)
      * gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification     (CVE-2025-14831)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4492 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4492-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     February 25, 2026                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : gnutls28     Version        : 3.7.1-5+deb11u9     CVE ID         : CVE-2025-9820 CVE-2025-14831     Debian Bug     : 1121146

    Vulnerabilities were found in GnuTLS, a portable library which     implements the Transport Layer Security and Datagram Transport Layer     Security protocols, which may lead to Denial of Service.

    CVE-2025-9820

        An out-of-bound write issue was discovered when a PKCS#11 token is         initialized with the `gnutls_pkcs11_token_init()` function and it is         passed a token label longer than 32 characters.

    CVE-2025-14831

        Tim Scheckenbach discovered that verifying specially crafted         malicious certificates containing a large number of name constraints         and subject alternative names (SANs) could lead to resource         exhaustion.

    For Debian 11 bullseye, these problems have been fixed in version     3.7.1-5+deb11u9.

    We recommend that you upgrade your gnutls28 packages.

    For the detailed security status of gnutls28 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/gnutls28

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6140 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6140-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     February 18, 2026                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : gnutls28     CVE ID         : CVE-2025-14831

    Tim Scheckenbach reported a flaw in GnuTLS, a library implementing the     TLS and SSL protocols. Processing of specially crafted certificates     containing a large number of name constraints may result in denial of     service (resource exhaustion).

    For the oldstable distribution (bookworm), this problem has been fixed     in version 3.7.9-2+deb12u6. This update also includes a fix for     CVE-2025-9820.

    For the stable distribution (trixie), this problem has been fixed in     version 3.8.9-3+deb13u2.

    We recommend that you upgrade your gnutls28 packages.

    For the detailed security status of gnutls28 please refer to its     security tracker page at:
    https://security-tracker.debian.org/tracker/gnutls28

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8043-1 advisory.

    Tim Scheckenbach discovered that GnuTLS incorrectly handled malicious certificates containing a large     number of name constraints and subject alternative names. A remote attacker could possibly use this issue     to cause GnuTLS to consume resources, resulting in a denial of service. (CVE-2025-14831)

    Luigino Camastra discovered that GnuTLS incorrectly handled certain PKCS11 token labels. A remote attacker     could use this issue to cause GnuTLS to crash, resulting in a denial of service, or possibly execute     arbitrary code. The default compiler options for affected releases should reduce the vulnerability to a     denial of service. (CVE-2025-9820)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of gnutls installed on the remote host is prior to 3.8.12. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-042-01 advisory.

    New gnutls packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the gnutls security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the gnutls-3.8.10-3.el9 build changelog.

  - A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central     Processing Unit) and memory consumption via specially crafted malicious certificates containing a large     number of name constraints and subject alternative names (SANs). (CVE-2025-14831)

  - A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that     handles PKCS#11 token initialization. When a token label longer than expected is processed, the function     writes past the end of a fixed-size stack buffer. This programming error can cause the application using     GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or     applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation     attacks. (CVE-2025-9820)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2b6035ee2b advisory.

    This backports fixes for a couple CVEs:

    ** libgnutls: Fix NULL pointer dereference in PSK binder verification A TLS 1.3 resumption attempt with an     invalid PSK binder value in ClientHello could lead to a denial of service attack via crashing the server.
    The updated code guards against the problematic dereference. Reported by Jaehun Lee. [Fixes: GNUTLS-     SA-2026-02-09-1, CVSS: high] [CVE-2026-1584]

    ** libgnutls: Fix name constraint processing performance issue Verifying certificates with pathological     amounts of name constraints could lead to a denial of service attack via resource exhaustion. Reworked     processing algorithms exhibit better performance characteristics. Reported by Tim Scheckenbach. [Fixes:
    GNUTLS-SA-2026-02-09-2, CVSS: medium] [CVE-2025-14831]

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ef7170c9f6 advisory.

    This fixes a couple CVEs:

    ** libgnutls: Fix NULL pointer dereference in PSK binder verification A TLS 1.3 resumption attempt with an     invalid PSK binder value in ClientHello could lead to a denial of service attack via crashing the server.
    The updated code guards against the problematic dereference. Reported by Jaehun Lee. [Fixes: GNUTLS-     SA-2026-02-09-1, CVSS: high] [CVE-2026-1584]

    ** libgnutls: Fix name constraint processing performance issue Verifying certificates with pathological     amounts of name constraints could lead to a denial of service attack via resource exhaustion. Reworked     processing algorithms exhibit better performance characteristics. Reported by Tim Scheckenbach. [Fixes:
    GNUTLS-SA-2026-02-09-2, CVSS: medium] [CVE-2025-14831]

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central     Processing Unit) and memory consumption via specially crafted malicious certificates containing a large     number of name constraints and subject alternative names (SANs). (CVE-2025-14831)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
303856	AlmaLinux 8 : gnutls (ALSA-2026:5585)	Nessus	Alma Linux Local Security Checks	medium
303499	Oracle Linux 8 : gnutls (ELSA-2026-5585)	Nessus	Oracle Linux Local Security Checks	medium
303422	RHEL 8 : gnutls (RHSA-2026:5585)	Nessus	Red Hat Local Security Checks	medium
302222	AlmaLinux 9 : gnutls (ALSA-2026:4188)	Nessus	Alma Linux Local Security Checks	medium
302126	Oracle Linux 9 : gnutls (ELSA-2026-50149)	Nessus	Oracle Linux Local Security Checks	medium
302057	Oracle Linux 9 : gnutls (ELSA-2026-4188)	Nessus	Oracle Linux Local Security Checks	medium
301922	MiracleLinux 9 : gnutls-3.8.3-10.el9_7 (AXSA:2026-285:01)	Nessus	Miracle Linux Local Security Checks	medium
301843	RHEL 9 : gnutls (RHSA-2026:4188)	Nessus	Red Hat Local Security Checks	medium
301822	RockyLinux 9 : gnutls (RLSA-2026:4188)	Nessus	Rocky Linux Local Security Checks	medium
301304	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : gnutls (SUSE-SU-2026:0829-1)	Nessus	SuSE Local Security Checks	medium
301120	RockyLinux 10 : gnutls (RLSA-2026:3477)	Nessus	Rocky Linux Local Security Checks	medium
301030	Oracle Linux 10 : gnutls (ELSA-2026-3477)	Nessus	Oracle Linux Local Security Checks	medium
301029	RHEL 10 : gnutls (RHSA-2026:3477)	Nessus	Red Hat Local Security Checks	medium
300766	AlmaLinux 10 : gnutls (ALSA-2026:3477)	Nessus	Alma Linux Local Security Checks	medium
299974	Debian dla-4492 : gnutls-bin - security update	Nessus	Debian Local Security Checks	medium
299381	Debian dsa-6140 : gnutls-bin - security update	Nessus	Debian Local Security Checks	medium
299331	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 : GnuTLS vulnerabilities (USN-8043-1)	Nessus	Ubuntu Local Security Checks	medium
299279	Slackware Linux 15.0 / current gnutls Multiple Vulnerabilities (SSA:2026-042-01)	Nessus	Slackware Local Security Checks	medium
299202	CentOS 9 : gnutls-3.8.10-3.el9	Nessus	CentOS Local Security Checks	medium
299149	Fedora 42 : gnutls (2026-2b6035ee2b)	Nessus	Fedora Local Security Checks	medium
298695	Fedora 43 : gnutls (2026-ef7170c9f6)	Nessus	Fedora Local Security Checks	medium
298391	Linux Distros Unpatched Vulnerability : CVE-2025-14831	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-14831

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium