CVE-2020-24659
An issue was discovered in GnuTLS before 3.6.15.
Published Sep 4, 2020 · updated Oct 14, 2026 · gnu gnutls
An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit function is called after detecting a handshake failure.
Timeline
Detection, updates, and resolution for this record.
Sep 4, 2020 · NIST NVD
Detected
An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit function is called after detecting a handshake failure.
Oct 14, 2026 · NIST NVD
Updated
An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit function is called after detecting a handshake failure.
Affected
- cpe canonical/ubuntu linux20.04
- cpe fedoraproject/fedora32
- cpe fedoraproject/fedora33
- cpe gnu/gnutlsversion unspecified
- cpe opensuse/leap15.1
- cpe opensuse/leap15.2
Sources
- CVE.orgCVE-2020-24659
Official CVE identifier
cve.org - FIRST EPSSCVE-2020-24659
30-day exploitation probability 3.8%
first.org - NIST NVDCVE-2020-24659
An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path
nvd.nist.gov