CVE-2025-6395 is a NULL pointer dereference vulnerability found in the GnuTLS library, specifically in the _gnutls_figure_common_ciphersuite() function. This vulnerability affects GnuTLS versions included in Red Hat Enterprise Linux 9 (>=9.0 <9.9) and 10 (>=10.0 <10.3), as well as an anomalous '=0' version entry. The issue can cause application crashes leading to denial of service (availability impact). Red Hat has issued security advisories RHSA-2025:16115 and RHSA-2025:16116 that provide updated packages fixing this vulnerability. The CVSS v3.1 base score is 6.5 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H), reflecting network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact. No exploits are currently known in the wild.

The vulnerability can cause a NULL pointer dereference resulting in application crashes, leading to denial of service (availability impact). There is no confidentiality impact and only a low integrity impact. No active exploitation has been reported.

Red Hat has released official security updates that fix this vulnerability for affected versions of Red Hat Enterprise Linux 9 and 10. Users should apply the updates as described in Red Hat advisories RHSA-2025:16115 and RHSA-2025:16116. The advisories provide detailed instructions and updated package versions. Applying these patches mitigates the vulnerability. No additional mitigation steps are indicated by the vendor.