CVE-2021-4209: gnu gnutls NULL Pointer Dereference
CVSS: 6.5v3.1MediumModified
AliasesMGASA-2022-0098SUSE-SU-2022:0677-1SUSE-SU-2022:0678-1SUSE-SU-2022:0717-1UBUNTU-CVE-2021-4209USN-5750-1DEBIAN-CVE-2021-4209openSUSE-SU-2022:0717-1
Published 24-08-2022Last modified 14-10-2026
Vulnerability summary
CVE-2021-4209 is a medium (CVSS 6.5) NULL Pointer Dereference vulnerability in gnu gnutls. EPSS estimates a 1.91% chance of exploitation in the next 30 days, higher than 79.4% of scored vulnerabilities.
CVSS score
6.5/10
010
Medium · v3.1 (NVD)EPSS score
1.91%
0%100%
Low · +0.16 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 3 · Related 2Timeline
- 24-08-2022PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances.
CVSS metrics
3 scores · 3 sources · 1 versionMedium 6.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.91%
Chance of exploitation in the next 30 days
Percentile
79%
Versus all other CVEs
30-day change
+0.16 pp
From 1.75% on 18-09-2026
18-09-202618-10-2026
EPSS score1.91%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Suse7 products
- gnutls&distro=SUSE Linux Enterprise Micro 5.0< 3.6.7-14.16.1
- gnutls&distro=SUSE Linux Enterprise Micro 5.1< 3.6.7-14.16.1
- gnutls&distro=SUSE Linux Enterprise Module for Basesystem 15 SP3< 3.6.7-14.16.1
- gnutls&distro=SUSE Linux Enterprise Real Time 15 SP2< 3.6.7-14.16.1
- gnutls&distro=SUSE Linux Enterprise Server 12 SP5< 3.3.27-3.6.1 | < 3.4.17-8.11.1
Netapp3 products
Ubuntu2 products
- gnutls26All versions (No fix recorded)
- gnutls28< 3.4.10-4ubuntu1.9+esm1 | < 3.5.18-1ubuntu1.6 | < 3.6.13-2ubuntu1.7
Debian1 product
- gnutls28< 3.7.3-2
Gnu1 product
- gnutls< 3.7.3
Mageia1 product
- gnutls< 3.6.15-3.2.mga8
Opensuse1 product
- gnutls&distro=openSUSE Leap 15.3< 3.6.7-14.16.1
Redhat1 product
8 vendors · 17 products
References
22 links- gitlab.com/gnutls/gnutls/-/commit/3db352734472d851318944db13be73da61300568X Refsource MISCPatchThird Party Advisory
