CVE-2009-1415
lib/pk-libgcrypt.c in libgnutls in GnuTLS before 2.6.6 does not properly handle invalid DSA...
lib/pk-libgcrypt.c in libgnutls in GnuTLS before 2.6.6 does not properly handle invalid DSA signatures, which allows remote attackers to cause a denial of service (application crash) and possibly have unspecified other impact via a malformed DSA key that triggers a (1) free of an uninitialized pointer or (2) double free.
Exploit likelihood
What each source reports
NVD Score used
lib/pk-libgcrypt.c in libgnutls in GnuTLS before 2.6.6 does not properly handle invalid DSA signatures, which allows remote attackers to cause a denial of service (application crash) and possibly have unspecified other impact via a malformed DSA key that triggers a (1) free of an uninitialized pointer or (2) double free.
- Record
CVE-2009-1415- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-824
- Updated
- 2026-11-02
CVE List No score
lib/pk-libgcrypt.c in libgnutls in GnuTLS before 2.6.6 does not properly handle invalid DSA signatures, which allows remote attackers to cause a denial of service (application crash) and possibly have unspecified other impact via a malformed DSA key that triggers a (1) free of an uninitialized pointer or (2) double free.
- Record
CVE-2009-1415- Updated
- 2026-11-02
EUVDEUVD-2009-1413 No score
lib/pk-libgcrypt.c in libgnutls in GnuTLS before 2.6.6 does not properly handle invalid DSA signatures, which allows remote attackers to cause a denial of service (application crash) and possibly have unspecified other impact via a malformed DSA key that triggers a (1) free of an uninitialized pointer or (2) double free.
- Record
EUVD-2009-1413- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2vg6-3mr6-w5mp No score
lib/pk-libgcrypt.c in libgnutls in GnuTLS before 2.6.6 does not properly handle invalid DSA...
lib/pk-libgcrypt.c in libgnutls in GnuTLS before 2.6.6 does not properly handle invalid DSA signatures, which allows remote attackers to cause a denial of service (application crash) and possibly have unspecified other impact via a malformed DSA key that triggers a (1) free of an uninitialized pointer or (2) double free.
- Record
GHSA-2vg6-3mr6-w5mp- Weakness
- CWE-824
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | GnuTLS 2.6.x - libgnutls lib/pk-libgcrypt.c Malformed DSA Key Handling Remote Denial of Service | 2009-04-30 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-1415 is a medium vulnerability (CVSS 4.3) in Gnu Gnutls, published April 30, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 7.92%, the 94th percentile. No source names a fixed version.
References
exchange.xforce.ibmcloud.com/vulnerabilities/50445
permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3502
article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3515
thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3488
Show 9 moreShow less
vupen.com/english/advisories/2009/1218
securityfocus.com/bid/34783
security.gentoo.org/glsa/glsa-200905-04.xml
securitytracker.com/id?1022157
secunia.com/advisories/34842
mandriva.com/security/advisories?name=MDVSA-2009:116
nvd.nist.gov/vuln/detail/CVE-2009-1415
github.com/advisories/GHSA-2vg6-3mr6-w5mp