CVE-2025-6395: gnutls28 NULL Pointer Dereference
CVSS: 6.5v3.1MediumDeferred
AliasesALPINE-CVE-2025-6395UBUNTU-CVE-2025-6395DEBIAN-CVE-2025-6395
Published 10-07-2025Last modified 15-10-2026
Vulnerability summary
CVE-2025-6395 is a medium (CVSS 6.5) NULL Pointer Dereference vulnerability in gnutls28. EPSS estimates a 0.77% chance of exploitation in the next 30 days, higher than 54.8% of scored vulnerabilities.
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)EPSS score
0.77%
0%100%
Low · +0.09 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 17 · Related 9Timeline
- 10-07-2025PublishedVulnerability first disclosed.
- 15-10-2026Last modifiedVulnerability information updated.
Description
A NULL pointer dereference flaw was found in the GnuTLS software in _gnutls_figure_common_ciphersuite().
CVSS metrics
5 scores · 5 sources · 1 versionMedium 6.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:HSourcesAll 5 agree
- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
EPSS trend
Probability
0.77%
Chance of exploitation in the next 30 days
Percentile
55%
Versus all other CVEs
30-day change
+0.09 pp
From 0.68% on 19-09-2026
19-09-202619-10-2026
EPSS score0.77%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- gnutls< 3.8.12-r0 | < 3.8.11-r0
Debian1 product
- gnutls28< 3.7.9-2+deb12u5 | < 3.8.9-3
Ubuntu1 product
- gnutls28< 3.6.13-2ubuntu1.12+esm1 | < 3.7.3-4ubuntu1.7 | All versions (No fix recorded) | < 3.7.3-4ubuntu1.7+Fips1 | < 3.8.3-1.1ubuntu3.4 | < 3.8.3-1.1ubuntu3.4+Fips1 | < 3.8.9-3ubuntu1
3 vendors · 3 products
