# CVE-2025-14831: Gnutls: gnutls: denial of service via excessive resource consumption during certificate verification

Status: published. Published: 2026-02-09. Updated: 2026-11-05.

A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).

## Remediation

No remediation reported in collected sources

## Affected products and versions

-  /  (gnutls): 0 (affected). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 10 (gnutls): ≥ 0:3.8.10-3.el10_1; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 10.0 Extended Update Support (gnutls): ≥ 0:3.8.9-9.el10_0.17; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8 (gnutls): ≥ 0:3.6.16-8.el8_10.5; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support (gnutls): ≥ 0:3.6.14-10.el8_4.1; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support (libtasn1): ≥ 0:4.13-3.el8_4.1; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On (gnutls): ≥ 0:3.6.14-10.el8_4.1; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On (libtasn1): ≥ 0:4.13-3.el8_4.1; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support (gnutls): ≥ 0:3.6.16-5.el8_6.5; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support (libtasn1): ≥ 0:4.13-3.el8_6.2; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On (gnutls): ≥ 0:3.6.16-5.el8_6.5; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On (libtasn1): ≥ 0:4.13-3.el8_6.2; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8.8 Telecommunications Update Service (gnutls): ≥ 0:3.6.16-7.el8_8.4; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8.8 Telecommunications Update Service (libtasn1): ≥ 0:4.13-4.el8_8.1; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions (gnutls): ≥ 0:3.6.16-7.el8_8.4; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions (libtasn1): ≥ 0:4.13-4.el8_8.1; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9 (gnutls): ≥ 0:3.8.3-10.el9_7; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions (gnutls): ≥ 0:3.7.6-21.el9_2.5; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9.4 Extended Update Support (gnutls): ≥ 0:3.8.3-4.el9_4.5; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9.6 Extended Update Support (gnutls): ≥ 0:3.8.3-6.el9_6.3; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / RHEL-8 based Middleware Containers (rhpam-7/rhpam-businesscentral-monitoring-rhel8): ≥ 7.13.5-4.1777325677; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / RHEL-8 based Middleware Containers (rhpam-7/rhpam-businesscentral-rhel8): ≥ 7.13.5-4.1777325711; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / RHEL-8 based Middleware Containers (rhpam-7/rhpam-controller-rhel8): ≥ 7.13.5-4.1777325710; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / RHEL-8 based Middleware Containers (rhpam-7/rhpam-dashbuilder-rhel8): ≥ 7.13.5-3.1777325680; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / RHEL-8 based Middleware Containers (rhpam-7/rhpam-kieserver-rhel8): ≥ 7.13.5-4.1777325709; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / RHEL-8 based Middleware Containers (rhpam-7/rhpam-process-migration-rhel8): ≥ 7.13.5-4.1777325680; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / RHEL-8 based Middleware Containers (rhpam-7/rhpam-smartrouter-rhel8): ≥ 7.13.5-4.1777325708; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Cert Manager support for Red Hat OpenShift release 1.18 (cert-manager/jetstack-cert-manager-acmesolver-rhel9): ≥ 1791459707; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Cert Manager support for Red Hat OpenShift release 1.18 (cert-manager/jetstack-cert-manager-rhel9): ≥ 1791459711; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Cert Manager support for Red Hat OpenShift release 1.18 (cert-manager/cert-manager-istio-csr-rhel9): ≥ 1791459759; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Cert Manager support for Red Hat OpenShift release 1.18 (cert-manager/cert-manager-operator-rhel9): ≥ 1789029076; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Cert Manager support for Red Hat OpenShift release 1.18 (cert-manager/cert-manager-operator-bundle): ≥ 1791966259; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat AI Inference Server 3.2 (rhaiis/model-opt-cuda-rhel9): ≥ 1780681984; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat AI Inference Server 3.2 (rhaiis/vllm-cuda-rhel9): ≥ 1775740563; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat AI Inference Server 3.3 (rhaiis/model-opt-cuda-rhel9): ≥ 1778244559; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat AI Inference Server 3.3 (rhaiis/vllm-rocm-rhel9): ≥ 1778244531; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat AI Inference Server 3.3 (rhaiis/vllm-spyre-rhel9): ≥ 1778244546; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat AI Inference Server 3.3 (rhaiis/vllm-cuda-rhel9): ≥ 1775680192; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat AI Inference Server 3.3 (rhaiis/vllm-rocm-rhel9): ≥ 1775680262; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat AI Inference Server 3.3 (rhaiis/model-opt-cuda-rhel9): ≥ 1775749857; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Ceph Storage 8 (rhceph/rhceph-8-rhel9): ≥ 1774002867; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Discovery 2 (discovery/discovery-server-rhel9): ≥ 1775668717; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Discovery 2 (discovery/discovery-ui-rhel9): ≥ 1775675922; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Hardened Images (gnutls-main): ≥ 3.8.12-1.1.hum1; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Insights proxy 1.5 (insights-proxy/insights-proxy-container-rhel9): ≥ 1773685509; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Update Infrastructure 5 (rhui5/cds-rhel9): ≥ 1773670073; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Update Infrastructure 5 (rhui5/haproxy-rhel9): ≥ 1773672059; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Update Infrastructure 5 (rhui5/installer-rhel9): ≥ 1773668803; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Update Infrastructure 5 (rhui5/rhua-rhel9): ≥ 1773670137; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 6 (gnutls): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 7 (gnutls): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (openshift/ose-rhel-coreos-8): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (openshift/ose-rhel-coreos-9): Version range not reported. Source: CNA: redhat
- Siemens / SIMATIC CN 4100: ≥ 0; < V5.0 (affected, custom). Source: ADP: siemens-SADP

## Severity and prioritization

- CVSS 3.1: 5.3 (medium); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L; source: CNA: redhat

- CISA KEV: No listing in collected sources

- EPSS: 0.66% as of 2026-11-05; percentile 51.56%

- SSVC: exploitation none; automatable yes; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-407

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://access.redhat.com/errata/RHSA-2026:13812 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:16008 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:16009 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:16174 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:25096 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:30849 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:30850 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:33125 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:3477 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:4188 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:4655 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:4943 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:5585 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:5606 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:6618 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:6630 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:6737 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:6738 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:7329 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:7335 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:7477 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:82347 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:82354 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:82372 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:82857 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:8746 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:8747 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:8748 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/security/cve/CVE-2025-14831 (CNA: redhat; vdb-entry, x_refsource_REDHAT)

- https://bugzilla.redhat.com/show_bug.cgi?id=2423177 (CNA: redhat; issue-tracking, x_refsource_REDHAT)

- https://gitlab.com/gnutls/gnutls/-/issues/1773 (CNA: redhat)

- https://cert-portal.siemens.com/productcert/html/ssa-032379.html (ADP: siemens-SADP)

## Provenance

- CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2025-14831; retrieved 2026-11-05; source updated 2026-11-05

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2025-14831; retrieved 2026-11-05; source updated Not reported

Revision: cf6a2821a5bd067b378d57bb833eb7584a0ae9ccd4aa1471d0017b95c38bd733

Canonical: https://y2.dev/cve/CVE-2025-14831

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.