CVE-2021-4209 Null dereference in GnuTLS

Medium 6.5 Published 24 Aug 2022 Updated 14 Oct 2026

An authenticated attacker can cause a denial of service in GnuTLS by providing zero-length input to hash update functions.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-4209?

CVE-2021-4209 is a medium-severity vulnerability in Gnu Gnutls, published on 24 Aug 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances.

Weakness: CWE-476

Which versions are affected by CVE-2021-4209?

It affects 5 products.

Linux distribution packages (10)

`gnutls` SUSE:Linux Enterprise Micro 5.0	All versions	`3.6.7-14.16.1`
`gnutls` SUSE:Linux Enterprise Micro 5.1	All versions	`3.6.7-14.16.1`
`gnutls` SUSE:Linux Enterprise Module for Basesystem 15 SP3	All versions	`3.6.7-14.16.1`
`gnutls` SUSE:Linux Enterprise Real Time 15 SP2	All versions	`3.6.7-14.16.1`
`gnutls` SUSE:Linux Enterprise Server 12 SP5	All versions	`3.3.27-3.6.1`
`gnutls` SUSE:Linux Enterprise Server 12 SP5	All versions	`3.4.17-8.11.1`
`gnutls` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	All versions	`3.3.27-3.6.1`
`gnutls` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	All versions	`3.4.17-8.11.1`
`gnutls` SUSE:Linux Enterprise Software Development Kit 12 SP5	All versions	`3.3.27-3.6.1`
`gnutls` openSUSE:Leap 15.3	All versions	`3.6.7-14.16.1`

Products include Gnu Gnutls, Netapp Active Iq Unified Manager, Netapp Hci Bootstrap Os, Netapp Solidfire \& Hci Management Node, Redhat Enterprise Linux.

How do I fix CVE-2021-4209?

Apply the vendor's patch.

Is CVE-2021-4209 being exploited?

There is no known exploitation of CVE-2021-4209 in the wild and no public exploit code.

All Gnu Gnutls vulnerabilities

Sources

Also known as DEBIAN-CVE-2021-4209, GHSA-xj78-h3gx-cm6v, JLSEC-2026-522, MGASA-2022-0098, OESA-2022-1889, SUSE-SU-2022:0677-1 and 5 more.