GNU LIBTASN1 vulnerabilities

13 CVEs affecting GNU LIBTASN1, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-13151, published 2026-01-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-3622, published 2015-05-12. Medium severity, CVSS 4.3. EPSS: 32.9% chance of exploitation in the next 30 days. The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.5 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted certificate.
CVE-2016-4008, published 2016-05-05. Medium severity, CVSS 5.9. EPSS: 29.4% chance of exploitation in the next 30 days. The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.8, when used without the ASN1_DECODE_FLAG_STRICT_DER flag, allows remote attackers to cause a denial of service…
CVE-2015-2806, published 2015-04-10. High severity, CVSS 10.0. EPSS: 7.7% chance of exploitation in the next 30 days. Stack-based buffer overflow in asn1_der_decoding in libtasn1 before 4.4 allows remote attackers to have unspecified impact via unknown vectors.
CVE-2014-3467, published 2014-06-05. Medium severity, CVSS 5.0. EPSS: 6.8% chance of exploitation in the next 30 days. Multiple unspecified vulnerabilities in the DER decoder in GNU Libtasn1 before 3.6, as used in GnuTLS, allow remote attackers to cause a denial of service (out-of-bounds read) via crafted ASN.1 data.
CVE-2017-6891, published 2017-05-22. High severity, CVSS 8.8. EPSS: 5.6% chance of exploitation in the next 30 days. Two errors in the "asn1_find_node()" function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-based buffer overflow by tricking a user into processing a…
CVE-2017-10790, published 2017-07-02. High severity, CVSS 7.5. EPSS: 4.9% chance of exploitation in the next 30 days. The _asn1_check_identifier function in GNU Libtasn1 through 4.12 causes a NULL pointer dereference and crash when reading crafted input that triggers assignment of a NULL value within an asn1_node…
CVE-2012-1569, published 2012-03-26. Medium severity, CVSS 5.0. EPSS: 4.4% chance of exploitation in the next 30 days. The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before 3.0.16 and other products, does not properly handle certain large length values, which allows…
CVE-2014-3469, published 2014-06-05. Medium severity, CVSS 5.0. EPSS: 3.8% chance of exploitation in the next 30 days. The (1) asn1_read_value_type and (2) asn1_read_value functions in GNU Libtasn1 before 3.6 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via a…
CVE-2014-3468, published 2014-06-05. High severity, CVSS 7.5. EPSS: 3.8% chance of exploitation in the next 30 days. The asn1_get_bit_der function in GNU Libtasn1 before 3.6 does not properly report an error when a negative bit length is identified, which allows context-dependent attackers to cause out-of-bounds…
CVE-2018-6003, published 2018-01-22. High severity, CVSS 7.5. EPSS: 2.8% chance of exploitation in the next 30 days. An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited recursion in the BER decoder leads to stack exhaustion and DoS.

Latest

CVE-2025-13151, published 2026-01-07. High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days. Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string.
CVE-2021-46848, published 2022-10-24. Critical severity, CVSS 9.1. EPSS: 2.3% chance of exploitation in the next 30 days. GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der.
CVE-2018-1000654, published 2018-08-20. Medium severity, CVSS 5.5. EPSS: 2% chance of exploitation in the next 30 days. GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in…