CVE-2025-9820: Red Hat Ceph Storage 8

Medium severity, CVSS 4.0. EPSS: 0.2% chance of exploitation in the next 30 days.

A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.

Affected products

  • Red Hat Red Hat Ceph Storage 8: before 1774002867 (fixed in 1774002867)
  • Red Hat Red Hat Discovery 2: before 1775668717 (fixed in 1775668717); before 1775675922 (fixed in 1775675922)
  • Red Hat Red Hat Enterprise Linux 10: before 0:3.8.10-3.el10_1 (fixed in 0:3.8.10-3.el10_1)
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8: before 0:3.6.16-8.el8_10.5 (fixed in 0:3.6.16-8.el8_10.5)
  • Red Hat Red Hat Enterprise Linux 9: before 0:3.8.3-10.el9_7 (fixed in 0:3.8.3-10.el9_7)
  • Red Hat Red Hat Hardened Images: before 3.8.12-1.1.hum1 (fixed in 3.8.12-1.1.hum1)
  • Red Hat Red Hat Insights Proxy 1.5: before 1773685509 (fixed in 1773685509)
  • Red Hat Red Hat Openshift Container Platform 4
  • Red Hat Red Hat Update Infrastructure 5: before 1773670073 (fixed in 1773670073); before 1773672059 (fixed in 1773672059); before 1773668803 (fixed in 1773668803); before 1773670137 (fixed in 1773670137)
  • Red Hat Rhel-8 Based Middleware Containers: before 7.13.5-4.1777325677 (fixed in 7.13.5-4.1777325677); before 7.13.5-4.1777325711 (fixed in 7.13.5-4.1777325711); before 7.13.5-4.1777325710 (fixed in 7.13.5-4.1777325710); before 7.13.5-3.1777325680 (fixed in 7.13.5-3.1777325680); before 7.13.5-4.1777325709 (fixed in 7.13.5-4.1777325709); before 7.13.5-4.1777325680 (fixed in 7.13.5-4.1777325680); …
  • Siemens SIMATIC Cn 4100: before V5.0 (fixed in V5.0)

Published 2026-01-26. Last modified 2026-09-01.