CVE-2024-28835 Gnutls: potential crash during chain building/verification
An attacker can cause a crash in GnuTLS by providing a specially crafted PEM bundle for chain verification, impacting applications using the certtool utility.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-28835?
CVE-2024-28835 is a medium-severity denial of service vulnerability in Red Hat Enterprise Linux 10, published on 21 Mar 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the "certtool --verify-chain" command.
Weakness: CWE-248
Which versions are affected by CVE-2024-28835?
How do I fix CVE-2024-28835?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-28835 being exploited?
There is no known exploitation of CVE-2024-28835 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2024-28835, AZL-37085, AZL-37108, BELL-CVE-2024-28835, CLSA-2024-1727373881, CLSA-2025-1749551514 and 9 more.