Vulnerability record · CVE-2019-3829 · published 27 March 2019
CVE-2019-3829: GnuTLS certificate verification double free memory corruption
Gnu · Gnutls
GnuTLS versions 3.5.8 through 3.6.6 contain a double free in the X.509 certificate verification API. Any client or server application that verifies certificates with an affected version can be crashed or corrupted by malformed certificate data. The flaw is remotely reachable and requires no authentication or user interaction.
Description
A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7. A memory corruption (double free) vulnerability in the certificate verification API. Any client or server application that verifies X.509 certificates with GnuTLS 3.5.8 or later is affected.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityRemote, unauthenticated memory corruption in a widely used TLS library with high EPSS and public exploit references, though impact is limited to denial of service.
What it is
GnuTLS versions 3.5.8 through 3.6.6 contain a double free in the X.509 certificate verification API. Any client or server application that verifies certificates with an affected version can be crashed or corrupted by malformed certificate data. The flaw is remotely reachable and requires no authentication or user interaction.
Impact
An attacker can corrupt memory in the certificate verification path, causing a denial of service through a crash. The record does not establish reliable code execution, so impact is limited to availability.
Attack surface
Reached over the network through the certificate verification API when a client or server processes an X.509 certificate. No authentication or user interaction is required per the CVSS vector AV:N/AC:L/PR:N/UI:N.
Exploitation
Not listed in CISA KEV, but EPSS is 0.58969 (99th percentile), indicating high predicted exploitation likelihood. Multiple references are tagged Exploit, including the GnuTLS advisory and the upstream GitLab issue.
What to do
- Upgrade GnuTLS to 3.6.7 or later, or apply the vendor patch referenced in GNUTLS-SA-2019-03-27.
- Apply distribution updates for Fedora, Red Hat, Ubuntu, Gentoo, openSUSE and NetApp products listed in the references.
- If immediate patching is not possible, restrict or disable certificate verification paths that process untrusted X.509 certificates.
- Track affected applications that bundle GnuTLS and confirm they use a patched library version.
Detection
- Monitor for crashes or abnormal process termination in applications using GnuTLS certificate verification.
- Check installed GnuTLS versions across hosts and flag any in the 3.5.8 to 3.6.6 range.
- Review logs for TLS handshake or certificate parsing failures preceding service restarts.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2019-3829 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-3829), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
