Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function

Summary

A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.

Timeline

1. Jan 26, 2026, 7:58 PM UTCCVE published
2. Jan 26, 2026, 8:10 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Oct 14, 2026, 7:46 PM UTCRecord last updated

Affected versions

• gnutls

  3.8.1, 3.8.2, 3.8.3, 3.8.4, 3.8.5, 3.8.6, 3.8.7, 3.8.8, 3.8.9, 3.8.10

• gnutls

  Version range not reported

• gnutls

  Version range not reported

• gnutls

  Version range not reported

• rhpam-7/rhpam-businesscentral-monitoring-rhel8

  Version range not reported

• rhpam-7/rhpam-businesscentral-rhel8

  Version range not reported

• rhpam-7/rhpam-controller-rhel8

  Version range not reported

• rhpam-7/rhpam-dashbuilder-rhel8

  Version range not reported

• rhpam-7/rhpam-kieserver-rhel8

  Version range not reported

• rhpam-7/rhpam-process-migration-rhel8

  Version range not reported

• rhpam-7/rhpam-smartrouter-rhel8

  Version range not reported

• cert-manager/jetstack-cert-manager-acmesolver-rhel9

  Version range not reported

• cert-manager/jetstack-cert-manager-rhel9

  Version range not reported

• cert-manager/cert-manager-istio-csr-rhel9

  Version range not reported

• cert-manager/cert-manager-operator-rhel9

  Version range not reported

• cert-manager/cert-manager-operator-bundle

  Version range not reported

• rhceph/rhceph-8-rhel9

  Version range not reported

• discovery/discovery-server-rhel9

  Version range not reported

• discovery/discovery-ui-rhel9

  Version range not reported

• gnutls-main

  Version range not reported

• insights-proxy/insights-proxy-container-rhel9

  Version range not reported

• rhui5/cds-rhel9

  Version range not reported

• rhui5/haproxy-rhel9

  Version range not reported

• rhui5/installer-rhel9

  Version range not reported

• rhui5/rhua-rhel9

  Version range not reported

• gnutls

  Version range not reported

• gnutls

  Version range not reported

• openshift/ose-rhel-coreos-8

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

References 18