CVE-2025-9820

Fixed in a distro release EPSS <1%CVSS 4.0

A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.

Published 2026-01-26 · CVE record · OSV

Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat RHEL-8 based Middleware Containers, Cert Manager support for Red Hat OpenShift release 1.18, Red Hat Ceph Storage 8, Red Hat Discovery 2, Red Hat Hardened Images, Red Hat Insights proxy 1.5, Red Hat Update Infrastructure 5, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4, Siemens SIMATIC CN 4100

Distro releases