Report
CVE-2022-2509: Double-free in GnuTLS certificate SAN extension parsing
37eb8a63-3a6a-4ae3-bf51-04947c42fa86
GnuTLS contains a double-free vulnerability (CVE-2022-2509) in the _gnutls_write_new_othername function when exporting otherName subject alternative names (SAN) extensions in X.509 certificates. When ASN.1 encoding operations fail, the function incorrectly frees the caller-allocated ASN1_TYPE structure, leading to a double-free when the caller's cleanup code attempts to free the same structure again. This affects certificate chain verification with specific extension parsing failures.