CVE-2024-28835

MediumCVSS 5.0

Published: 21/03/2024(UTC)Updated: 03/07/2026(UTC)Translated: 04/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

31th percentile - higher than 31% of all known CVEs

Summary

A flaw in GnuTLS can cause an application crash when verifying a specially crafted .pem bundle using the 'certtool --verify-chain' command.

Risk Assessment

An attacker could exploit this vulnerability to crash services or applications using GnuTLS for certificate chain verification, leading to a denial of service (DoS).

Recommendation

Update GnuTLS to the latest available version that includes a fix for CVE-2024-28835 immediately.

Original NVD description (English source)

A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the "certtool --verify-chain" command.