GnuTLS SAN Entry Export asn1_delete_structure double free

Summaryinfo

A vulnerability, which was classified as critical, has been found in GnuTLS. This affects the function asn1_delete_structure of the component SAN Entry Export. Performing a manipulation results in double free. This vulnerability is cataloged as CVE-2025-32988. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as critical, was found in GnuTLS (affected version unknown). This affects the function asn1_delete_structure of the component SAN Entry Export. The manipulation with an unknown input leads to a double free vulnerability. CWE is classifying the issue as CWE-415. The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1_delete_structure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function or caller later attempts to free the same structure. This vulnerability can be triggered using only public GnuTLS APIs and may result in denial of service or memory corruption, depending on allocator behavior.

It is possible to read the advisory at access.redhat.com. This vulnerability is uniquely identified as CVE-2025-32988 since 04/15/2025. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/28/2025).

The vulnerability scanner Nessus provides a plugin with the ID 242043 (Fedora 42 : gnutls (2025-16a24364ce)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (242043), EUVD (EUVD-2025-20928) and CERT Bund (WID-SEC-2025-1526). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• Gentoo Linux
• IBM Storwize
• RESF Rocky Linux
• IBM App Connect Enterprise
• IBM MQ
• Open Source GnuTLS
• Dell Secure Connect Gateway
• IBM QRadar SIEM
• Meinberg LANTIME

Productinfo

Type

• Network Encryption Software

Name

• GnuTLS

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion