PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-14831 Access CVE debrief

CVE-2025-14831 describes a denial-of-service condition in GnuTLS that can be triggered by specially crafted malicious certificates. The issue is tied to excessive CPU and memory consumption when certificates contain unusually large numbers of name constraints and subject alternative names (SANs).

Vendor
Access
Product
Unknown
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-09
Original CVE updated
2026-09-01
Advisory published
2026-02-09
Advisory updated
2026-09-01

Who should care

Administrators and developers who rely on GnuTLS for TLS certificate validation should care, especially if their services process untrusted certificates or are exposed to the network. Internet-facing TLS endpoints, gateways, proxies, and applications that validate client or peer certificates are the most likely to feel the operational impact.

Technical summary

The supplied NVD record rates this as CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), which indicates a network-reachable availability issue with no privileges or user interaction required. The vulnerability description says malformed certificates with a large number of name constraints and SANs can drive excessive CPU and memory usage during processing, creating a denial-of-service risk. NVD also lists secondary CWE-407.

Defensive priority

Medium. Treat this as a service-stability issue that becomes more important on systems that accept untrusted or attacker-controlled certificates. Prioritize remediation for exposed services and shared platforms where resource exhaustion could affect multiple users or tenants.

Recommended defensive actions

  • Track and apply vendor updates or errata that address this CVE for any product shipping GnuTLS.
  • Inventory where GnuTLS is used, including libraries embedded in applications and network appliances.
  • Limit exposure to untrusted certificate parsing paths where possible, and avoid unnecessary certificate validation on external inputs.
  • Monitor TLS-handling processes for unusual CPU or memory spikes that could indicate certificate-processing abuse.
  • Review Red Hat advisories and the linked GnuTLS issue for affected package guidance and downstream fix status.

Evidence notes

This debrief is based only on the supplied CVE/NVD corpus and official links. The NVD source item marks the vulnerability status as Deferred and provides the CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. The description states that malicious certificates with many name constraints and SANs can cause excessive CPU and memory consumption, resulting in denial of service. NVD references include multiple Red Hat advisories and the GnuTLS issue tracker entry 1773.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-14831 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-14831

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-14831 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-14831

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-134-10.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-032379.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-032379.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-10

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.