{"id":"CVE-2021-4209","aliases":["DEBIAN-CVE-2021-4209","DLA-3070-1","EUVD-2021-34067","GHSA-xj78-h3gx-cm6v","JLSEC-2026-522","MGASA-2022-0098","OESA-2022-1889","SUSE-SU-2022:0677-1","SUSE-SU-2022:0678-1","SUSE-SU-2022:0717-1","SUSE-SU-2022:2830-1","UBUNTU-CVE-2021-4209","USN-5550-1","USN-5750-1","openSUSE-SU-2022:0717-1"],"status":"published","title":"A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally...","description":"A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01908,"percentile":0.79914,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2022-02-22T20:07:00Z","modified":"2026-10-24T14:21:21Z","fixes":[{"ecosystem":"Debian:12","package":"gnutls28","fixed_in":["3.7.3-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gnutls28","fixed_in":["3.7.3-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gnutls28","fixed_in":["3.7.3-2"],"sources":["osv"]},{"ecosystem":"Julia","package":"GnuTLS_jll","fixed_in":["3.7.8+0"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"gnutls","fixed_in":["3.6.15-3.2.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"gnutls","fixed_in":["3.6.14-9.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"gnutls","fixed_in":["3.6.14-9.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"gnutls","fixed_in":["3.7.2-4.oe2203"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"gnutls","fixed_in":["3.3.27-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"gnutls","fixed_in":["3.3.27-3.6.1","3.4.17-8.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"gnutls","fixed_in":["3.3.27-3.6.1","3.4.17-8.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"gnutls","fixed_in":["3.6.7-14.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"gnutls","fixed_in":["3.6.7-14.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"gnutls","fixed_in":["3.6.7-14.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"gnutls","fixed_in":["3.6.7-14.16.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gnutls28","fixed_in":["3.4.10-4ubuntu1.9+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"gnutls28","fixed_in":["3.5.18-1ubuntu1.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"gnutls28","fixed_in":["3.6.13-2ubuntu1.7"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"gnutls","fixed_in":["3.6.7-14.16.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-2"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-4+deb10u9"}]}],"versions":["3.6.7-4","3.6.7-4+deb10u1","3.6.7-4+deb10u2","3.6.7-4+deb10u3","3.6.7-4+deb10u4","3.6.7-4+deb10u5","3.6.7-4+deb10u6","3.6.7-4+deb10u7","3.6.7-4+deb10u8"],"bundled":2},{"source":"osv","ecosystem":"Julia","package":"GnuTLS_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.7.8+0"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.15-3.2.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.14-9.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.14-9.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-4.oe2203"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.27-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.27-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.27-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.17-8.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.17-8.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-14.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-14.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-14.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-14.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-150000.6.45.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-150000.6.45.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-150000.6.45.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-150000.6.45.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-150000.6.45.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-150000.6.45.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-150000.6.45.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-150000.6.45.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-150000.6.45.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-150000.6.45.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"gnutls26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.23-1ubuntu4","2.12.23-1ubuntu5","2.12.23-12ubuntu1","2.12.23-12ubuntu2","2.12.23-12ubuntu2.1","2.12.23-12ubuntu2.2","2.12.23-12ubuntu2.3","2.12.23-12ubuntu2.4","2.12.23-12ubuntu2.5","2.12.23-12ubuntu2.6","2.12.23-12ubuntu2.7","2.12.23-12ubuntu2.8","2.12.23-12ubuntu2.10+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.10-4ubuntu1.9+esm1"}]}],"versions":["3.3.15-5ubuntu2","3.3.18-1ubuntu1","3.3.20-1ubuntu1","3.4.9-2ubuntu1","3.4.10-4ubuntu1","3.4.10-4ubuntu1.1","3.4.10-4ubuntu1.2","3.4.10-4ubuntu1.3","3.4.10-4ubuntu1.4","3.4.10-4ubuntu1.5","3.4.10-4ubuntu1.6","3.4.10-4ubuntu1.7","3.4.10-4ubuntu1.8","3.4.10-4ubuntu1.9"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.18-1ubuntu1.6"}]}],"versions":["3.5.8-6ubuntu3","3.5.17-1ubuntu1","3.5.17-1ubuntu3","3.5.18-1ubuntu1","3.5.18-1ubuntu1.1","3.5.18-1ubuntu1.2","3.5.18-1ubuntu1.3","3.5.18-1ubuntu1.4","3.5.18-1ubuntu1.5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.13-2ubuntu1.7"}]}],"versions":["3.6.9-5ubuntu1","3.6.9-5ubuntu2","3.6.10-5","3.6.11.1-2","3.6.11.1-2ubuntu2","3.6.13-2ubuntu1","3.6.13-2ubuntu1.1","3.6.13-2ubuntu1.2","3.6.13-2ubuntu1.3","3.6.13-2ubuntu1.6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.18-1ubuntu1.6"}]}],"versions":["3.5.8-6ubuntu3","3.5.17-1ubuntu1","3.5.17-1ubuntu3","3.5.18-1ubuntu1","3.5.18-1ubuntu1.1","3.5.18-1ubuntu1.2","3.5.18-1ubuntu1.3","3.5.18-1ubuntu1.4","3.5.18-1ubuntu1.5"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.13-2ubuntu1.7"}]}],"versions":["3.6.9-5ubuntu1","3.6.9-5ubuntu2","3.6.10-5","3.6.11.1-2","3.6.11.1-2ubuntu2","3.6.13-2ubuntu1","3.6.13-2ubuntu1.1","3.6.13-2ubuntu1.2","3.6.13-2ubuntu1.3","3.6.13-2ubuntu1.6"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-4ubuntu1.1"}]}],"versions":["3.7.1-5ubuntu1","3.7.2-2ubuntu1","3.7.2-4ubuntu1","3.7.2-5ubuntu1","3.7.3-4ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.10-4ubuntu1.9+esm1"}]}],"versions":["3.3.15-5ubuntu2","3.3.18-1ubuntu1","3.3.20-1ubuntu1","3.4.9-2ubuntu1","3.4.10-4ubuntu1","3.4.10-4ubuntu1.1","3.4.10-4ubuntu1.2","3.4.10-4ubuntu1.3","3.4.10-4ubuntu1.4","3.4.10-4ubuntu1.5","3.4.10-4ubuntu1.6","3.4.10-4ubuntu1.7","3.4.10-4ubuntu1.8","3.4.10-4ubuntu1.9"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-14.16.1"}]}]}],"products":[{"vendor":"gnu","product":"gnutls"},{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"netapp","product":"hci_bootstrap_os"},{"vendor":"netapp","product":"solidfire_\\\u0026_hci_management_node"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://gitlab.com/gnutls/gnutls/-/issues/1306","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044156","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-4209","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://gitlab.com/gnutls/gnutls/-/merge_requests/1503","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://gitlab.com/gnutls/gnutls/-/commit/3db352734472d851318944db13be73da61300568","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://security.netapp.com/advisory/ntap-20220915-0005/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4209","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20220915-0005"},{"url":"https://github.com/advisories/GHSA-xj78-h3gx-cm6v"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-4209","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0098.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30112","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2022-March/010333.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RI5PFWTNO6UDYFJ3HLMKV5PQYAJ77E46/","tags":["web","advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1889","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220677-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1196167","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-4209","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220678-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220717-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222830-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1202020","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2509","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-4209","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5550-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5750-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-4209","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-2509","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-4209","description":"A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances.","status":"published","published":"2022-08-24T15:07:31Z","modified":"2026-10-14T10:04:07.798Z","cwes":["CWE-476"],"updated_at":"2026-11-02T14:33:07.697752Z"}],"euvd":[{"id":"EUVD-2021-34067","description":"A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances.","status":"published","published":"2022-08-24T15:07:31Z","modified":"2026-10-14T10:04:07Z","updated_at":"2026-11-02T17:27:16.85534Z"}],"ghsa":[{"id":"GHSA-xj78-h3gx-cm6v","title":"A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally...","description":"A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances.","status":"published","published":"2022-08-25T00:00:27Z","modified":"2026-10-14T12:32:27Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:13:24.812204Z"}],"nvd":[{"id":"CVE-2021-4209","description":"A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances.","status":"published","published":"2022-08-24T16:15:09.927Z","modified":"2026-10-14T11:16:55.207Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:07:06.906968Z"}],"osv":[{"id":"CVE-2021-4209","description":"A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances.","status":"published","published":"2022-08-24T16:15:09.927Z","modified":"2026-10-24T14:21:21.580260198Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:21.557945Z"},{"id":"DEBIAN-CVE-2021-4209","description":"A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances.","status":"published","published":"2022-08-24T16:15:09.927Z","modified":"2026-10-15T09:47:36.379239138Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:35.799676Z"},{"id":"JLSEC-2026-522","description":"A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances.","status":"published","published":"2026-05-26T14:17:50.003Z","modified":"2026-07-18T00:01:00.841342836Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2022-1889","title":"gnutls security update","description":"GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, and other required structures.The project strives to provide a secure communications back-end, simple to use and integrated with the rest of the base Linux libraries. A back-end designed to work and be secure out of the box, keeping the complexity of TLS and PKI out of application code.\r\n\r\nSecurity Fix(es):\r\n\r\nA NULL pointer dereference flaw was found in GnuTLS. As Nettle\u0026apos;s hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances.(CVE-2021-4209)","status":"published","published":"2022-09-02T11:05:09Z","modified":"2026-08-18T01:17:17.113302005Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2021-4209","description":"A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances.","status":"published","published":"2022-02-22T20:07:00Z","modified":"2026-07-22T11:34:31.378979112Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:29.220315Z"},{"id":"DLA-3070-1","title":"gnutls28 - security update","status":"published","published":"2022-08-11T00:00:00Z","modified":"2026-03-09T01:19:37.354447Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"MGASA-2022-0098","title":"Updated gnutls packages fix security vulnerability","description":"Null pointer dereference in MD_UPDATE. (CVE-2021-4209)\n","status":"published","published":"2022-03-12T03:07:34Z","modified":"2026-04-16T04:41:28.726361197Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2022:0717-1","title":"Security update for gnutls","description":"This update for gnutls fixes the following issues:\n\n- CVE-2021-4209: Fixed null pointer dereference in MD_UPDATE (bsc#1196167).\n","status":"published","published":"2022-03-04T08:45:39Z","modified":"2026-02-04T03:34:28.315217Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"SUSE-SU-2022:0677-1","title":"Security update for gnutls","description":"This update for gnutls fixes the following issues:\n\n- CVE-2021-4209: Fixed null pointer dereference in MD_UPDATE (bsc#1196167).\n","status":"published","published":"2022-03-02T18:07:24Z","modified":"2026-02-04T03:19:18.548878Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0678-1","title":"Security update for gnutls","description":"This update for gnutls fixes the following issues:\n\n- CVE-2021-4209: Fixed null pointer dereference in MD_UPDATE (bsc#1196167).\n","status":"published","published":"2022-03-02T18:07:29Z","modified":"2026-02-04T04:06:14.908102Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0717-1","title":"Security update for gnutls","description":"This update for gnutls fixes the following issues:\n\n- CVE-2021-4209: Fixed null pointer dereference in MD_UPDATE (bsc#1196167).\n","status":"published","published":"2022-03-04T08:45:44Z","modified":"2026-02-04T03:49:07.002083Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:2830-1","title":"Security update for gnutls","description":"This update for gnutls fixes the following issues:\n\n- CVE-2022-2509: Fixed a double free issue during PKCS7 verification (bsc#1202020).\n- CVE-2021-4209: Fixed null pointer dereference in MD_UPDATE (bsc#1196167). \n","status":"published","published":"2022-08-17T12:36:56Z","modified":"2026-02-04T02:40:36.67944Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"USN-5550-1","title":"gnutls28 vulnerabilities","description":"It was discovered that GnuTLS incorrectly handled certain memory\noperations. A remote attacker could possibly use this issue to cause GnuTLS\nto crash, resulting in a denial of service. This issue only affected Ubuntu\n18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-4209)\n\nIt was discovered that GnuTLS incorrectly handled the verification of\ncertain pkcs7 signatures. A remote attacker could use this issue to cause\nGnuTLS to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2022-2509)\n","status":"published","published":"2022-08-04T16:07:06Z","modified":"2026-04-27T19:32:12.142521271Z","updated_at":"2026-11-02T16:58:16.20937Z"},{"id":"USN-5750-1","title":"gnutls28 vulnerability","description":"It was discovered that GnuTLS incorrectly handled certain memory\noperations. A remote attacker could possibly use this issue to cause GnuTLS\nto crash, resulting in a denial of service.\n","status":"published","published":"2022-11-30T06:06:29Z","modified":"2026-06-25T13:31:36.646861685Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}