CVE-2021-4209: GNU Gnutls

Medium severity, CVSS 6.5. EPSS: 1.7% chance of exploitation in the next 30 days.

A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances.

Affected products

• GNU Gnutls: before 3.7.3 (fixed in 3.7.3)
• Netapp Active Iq Unified Manager: affected versions not specified
• Netapp Hci Bootstrap OS: affected versions not specified
• Netapp Solidfire & Hci Management Node: affected versions not specified
• Red Hat Enterprise Linux: version 8.0 only

Published 2022-08-24. Last modified 2026-06-17.