FAIL › dossier
gnu
VENDOR· dossier confidence 50%
GNU, a foundational software organization, exhibits a concerning pattern of high-severity vulnerabilities, particularly remote code execution flaws, across its core components. This history raises significant security concerns for organizations relying on GNU software.
PROFILE
CategorySoftware FoundationWhat they doThe GNU Project develops and maintains free software, including the GNU operating system and numerous utilities. It is a collaborative project involving numerous developers worldwide.
SECURITY POSTURE
GNU has a history of high-severity remote code execution (RCE) vulnerabilities across multiple core components, indicating a potential weakness in secure coding practices and vulnerability management. The repeated occurrence of these vulnerabilities suggests systemic issues.
Notable failures
- CVE-2026-24061 (RCE)
- CVE-2014-6278 (RCE)
- CVE-2014-6271 (RCE)
- CVE-2023-4911 (Code Execution)
- CVE-2026-42010 (Authentication Bypass)
- CVE-2026-33845 (Out-of-bounds Write)
Patterns: Repeated RCE vulnerabilities; Vulnerabilities in core utilities (Bash, InetUtils, C Library); Integer underflow vulnerabilities; Authentication bypass vulnerabilities
FAILURE HISTORY · 20
| DATE | EVENT | SEV | SUMMARY |
|---|---|---|---|
| 2022-01-28 | CVE-2014-6271 | high | A remote code execution flaw in GNU Bash allowed attackers to execute arbitrary code via environment variables in versions 4.3 and earlier. |
| 2022-01-28 | CVE-2014-7169 | high | A remote code execution flaw in GNU Bash allowed attackers to execute arbitrary code via environment variables, a known vulnerability that remains actively exploited in the wild. |
| 2026-01-26 | CVE-2026-24061 | high | GNU InetUtils telnetd exposed to remote authentication bypass |
| 2025-10-02 | CVE-2014-6278 | high | GNU Bash OS command injection allowed remote code execution |
| 2023-11-21 | CVE-2023-4911 | high | Local attacker can execute code with elevated privileges due to buffer overflow in GNU C Library. |
| 2026-05-07 | CVE-2026-42010 | high | A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authe |
| 2026-04-30 | CVE-2026-33845 | high | A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of |
| 2023-02-06 | CVE-2023-0687 | medium | CVE-2023-0687: A vulnerability was found in GNU C Library 2.38. It has been declared as critica |
| 2023-02-03 | CVE-2023-25139 | critical | CVE-2023-25139: sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds w |
| 2022-10-24 | CVE-2021-46848 | critical | CVE-2021-46848: GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affe |
| 2022-01-14 | CVE-2022-23219 | critical | CVE-2022-23219: The deprecated compatibility function clnt_create in the sunrpc module of the GN |
| 2022-01-14 | CVE-2022-23218 | critical | CVE-2022-23218: The deprecated compatibility function svcunix_create in the sunrpc module of the |
| 2021-07-22 | CVE-2021-35942 | critical | CVE-2021-35942: The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or |
| 2021-05-25 | CVE-2021-33574 | critical | CVE-2021-33574: The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 h |
| 2021-03-12 | CVE-2021-20232 | critical | CVE-2021-20232: A flaw was found in gnutls. A use after free issue in client_send_params in lib/ |
| 2021-03-12 | CVE-2021-20231 | critical | CVE-2021-20231: A flaw was found in gnutls. A use after free issue in client sending key_share e |
| 2020-10-06 | CVE-1999-0199 | critical | CVE-1999-0199: manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement |
| 2019-10-21 | CVE-2019-18224 | critical | CVE-2019-18224: idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based bu |
| 2019-07-15 | CVE-2019-1010022 | critical | CVE-2019-1010022: GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may |
| 2019-02-26 | CVE-2019-9169 | critical | CVE-2019-9169: In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in pos |
SENTIMENT · TRUSTED SOURCES
synthesisneutral+0.00
Factual, technical remediation note without sentiment.
synthesisneutral+0.00
No sentiment expressed in provided sources.
synthesisneutral+0.00
No coverage found in provided sources.
Neutral; no sentiment expressed.
Neutral; no sentiment expressed.
Neutral; no sentiment expressed.
Neutral; no sentiment expressed.
Neutral; no sentiment expressed.
Neutral; no sentiment expressed.
Factual, technical remediation note without sentiment.
"GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code. This CVE correctly remediates the vulnerability in CVE-2014-6271."
Neutral; no sentiment expressed.
No coverage found in provided sources.
No coverage found in provided sources.
No coverage found in provided sources.
No coverage found in provided sources.
No coverage found in provided sources.
No coverage found in provided sources.
Open questions: What is GNU's vulnerability disclosure process? · What are GNU's internal security testing and code review practices? · What is the extent of GNU's reliance on external contributions and how are those contributions vetted?
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-07-22 04:25:04.935640+00:00