CVE-2025-32989: Gnutls: vulnerability in gnutls sct extension parsing
A heap-buffer-overread vulnerability exists in GnuTLS (confirmed in version 3.8.9) due to unsafe handling of the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension during X.509 certificate parsing. The vulnerability can be triggered by a malicious peer presenting a crafted certificate containing a malformed SCT extension (OID 1.3.6.1.4.1.11129.2.4.2). This overread may lead to disclosure of heap memory contents to attackers if the SCT logid is logged, exported, or otherwise exposed by the application consuming the GnuTLS client library.
Other sources
A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension during X.509 certificate parsing. This flaw allows a malicious user to create a certificate containing a malformed SCT extension (OID 1.3.6.1.4.1.11129.2.4.2) that contains sensitive data. This issue leads to the exposure of confidential information when GnuTLS verifies certificates from certain websites when the certificate (SCT) is not checked correctly.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32989?
CVE-2025-32989 is classified as a medium severity vulnerability due to the potential for heap-buffer-overread in GnuTLS.
How do I fix CVE-2025-32989?
To mitigate CVE-2025-32989, ensure you update GnuTLS to the latest version where the vulnerability has been patched.
What impact does CVE-2025-32989 have on system security?
CVE-2025-32989 could allow attackers to exploit malformed SCT extensions, potentially leading to information disclosure or other security breaches.
Which versions of GnuTLS are affected by CVE-2025-32989?
CVE-2025-32989 affects all versions of GnuTLS that do not include the patch for this specific vulnerability.
Who reported CVE-2025-32989?
CVE-2025-32989 was reported by security researchers who identified the heap-buffer-overread issue during analysis of GnuTLS.