Do Son 
The maintainers of GnuTLS, a core library used by countless applications to secure network communications, have released a vital update to address two denial-of-service (DoS) vulnerabilities. Released on February 9, 2026, version 3.8.12 fixes flaws that could allow attackers to crash servers or exhaust system resources with specially crafted requests.
The update focuses on hardening libgnutls against attacks that exploit specific weaknesses in the TLS handshake process and certificate verification.
The more severe of the two issues, tracked as CVE-2026-1584, is a high-severity “NULL pointer dereference” bug that strikes during the TLS 1.3 resumption phase.
TLS resumption is designed to speed up connections by remembering previous sessions. However, a flaw in how the library handles the “PSK binder”—a security check used to bind the pre-shared key to the current handshake—created a fragile point.
The advisory explains: “A TLS 1.3 resumption attempt with an invalid PSK binder value in ClientHello could lead to a denial of service attack via crashing the server”.
By sending a malformed “ClientHello” packet with an invalid binder, an attacker could trick the server into trying to read memory that doesn’t exist (a NULL pointer), forcing the application to terminate immediately. The fix involves updated code that “guards against the problematic dereference”.
The second vulnerability, CVE-2025-14831, is a medium-severity issue related to resource exhaustion. It targets the certificate verification process, specifically how the library handles “name constraints”—rules that limit which domains a certificate authority can vouch for.
Attackers could exploit this by presenting a certificate loaded with an excessive number of these constraints. “Verifying certificates with pathological amounts of name constraints could lead to a denial of service attack via resource exhaustion,” the report states.
Processing these “pathological” certificates would consume so much CPU power that the server would become unresponsive. The developers have reworked the processing algorithms to “exhibit better performance characteristics,” ensuring that even complex certificates don’t bring the system to a halt.
Both vulnerabilities are resolved in GnuTLS version 3.8.12. Administrators and developers relying on GnuTLS for secure communications are urged to update their libraries immediately to prevent potential service disruptions.
Related Posts:
- PyPI Takes Emergency Measures to Combat Malicious Package Flood
- Microsoft Defender no longer considered Tor Browser as a trojan
- MITRE Warns of CVE Program Disruption as U.S. Contract Set to Expire
- Google Enables TLS by Default on Android P
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
