ZeroDay Findings
Sign inSign up

Findings

CVE-2020-24659

An issue was discovered in GnuTLS before 3.6.15.

Published Sep 4, 2020 · updated Oct 14, 2026 · gnu gnutls

An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit function is called after detecting a handshake failure.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 4, 2020 · NIST NVD

    Detected

    An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit function is called after detecting a handshake failure.

  2. Oct 14, 2026 · NIST NVD

    Updated

    An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit function is called after detecting a handshake failure.

Affected

  • cpe canonical/ubuntu linux20.04
  • cpe fedoraproject/fedora32
  • cpe fedoraproject/fedora33
  • cpe gnu/gnutlsversion unspecified
  • cpe opensuse/leap15.1
  • cpe opensuse/leap15.2

Sources

  • CVE.orgVulnerability recordCVE-2020-24659

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2020-24659

    30-day exploitation probability 3.8%

    first.org
  • NIST NVDVulnerability recordCVE-2020-24659

    An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path

    nvd.nist.gov

References