PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-14831 Access CVE debrief

CVE-2025-14831 describes a denial-of-service condition in GnuTLS that can be triggered by specially crafted malicious certificates. The issue is tied to excessive CPU and memory consumption when certificates contain unusually large numbers of name constraints and subject alternative names (SANs).

Vendor
Access
Product
Unknown
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-09
Original CVE updated
2026-05-12
Advisory published
2026-02-09
Advisory updated
2026-05-12

Who should care

Administrators and developers who rely on GnuTLS for TLS certificate validation should care, especially if their services process untrusted certificates or are exposed to the network. Internet-facing TLS endpoints, gateways, proxies, and applications that validate client or peer certificates are the most likely to feel the operational impact.

Technical summary

The supplied NVD record rates this as CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), which indicates a network-reachable availability issue with no privileges or user interaction required. The vulnerability description says malformed certificates with a large number of name constraints and SANs can drive excessive CPU and memory usage during processing, creating a denial-of-service risk. NVD also lists secondary CWE-407.

Defensive priority

Medium. Treat this as a service-stability issue that becomes more important on systems that accept untrusted or attacker-controlled certificates. Prioritize remediation for exposed services and shared platforms where resource exhaustion could affect multiple users or tenants.

Recommended defensive actions

  • Track and apply vendor updates or errata that address this CVE for any product shipping GnuTLS.
  • Inventory where GnuTLS is used, including libraries embedded in applications and network appliances.
  • Limit exposure to untrusted certificate parsing paths where possible, and avoid unnecessary certificate validation on external inputs.
  • Monitor TLS-handling processes for unusual CPU or memory spikes that could indicate certificate-processing abuse.
  • Review Red Hat advisories and the linked GnuTLS issue for affected package guidance and downstream fix status.

Evidence notes

This debrief is based only on the supplied CVE/NVD corpus and official links. The NVD source item marks the vulnerability status as Deferred and provides the CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. The description states that malicious certificates with many name constraints and SANs can cause excessive CPU and memory consumption, resulting in denial of service. NVD references include multiple Red Hat advisories and the GnuTLS issue tracker entry 1773.

Official resources

Publicly disclosed in the CVE record on 2026-02-09; the supplied NVD source item was last modified on 2026-05-12. No KEV entry is provided in the supplied data.