Red Hat Security Advisory

RHSA-2026:33125

gnutls and libtasn1 security update

Released 2026-06-29 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream AUS (v.8.4) gnutls-c++-3.6.14-10.el8_4.1, gnutls-dane-3.6.14-10.el8_4.1, gnutls-devel-3.6.14-10.el8_4.1 +3
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) gnutls-c++-3.6.14-10.el8_4.1, gnutls-dane-3.6.14-10.el8_4.1, gnutls-devel-3.6.14-10.el8_4.1 +3
Red Hat Enterprise Linux BaseOS AUS (v.8.4) gnutls-3.6.14-10.el8_4.1, libtasn1-4.13-3.el8_4.1
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) gnutls-3.6.14-10.el8_4.1, libtasn1-4.13-3.el8_4.1

Fixes 13 records

TI-2026-03321 CVE-2026-3833 · GHSA-6rgh-57xm-37v8

Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison

HIGH 72

A flaw was found in gnutls.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00565 Published 2026-04-30 Partial fix · 3.8.13, 3.8.10-4.el10_2 +42 CWE-178

TI-2026-26211 CVE-2026-33845 · GHSA-cmj5-x3xf-69wq

Gnutls: gnutls: denial of service via dtls zero-length fragment

MEDIUM 49

A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.02073 Published 2026-04-30 Partial fix · 3.8.13, 3.8.10-4.el10_2 +45 CWE-191

TI-2026-30398 CVE-2026-42010 · GHSA-m3r7-xjq8-gc4r

Gnutls: gnutls: authentication bypass via nul character in username

MEDIUM 44

A flaw was found in gnutls.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0105 Published 2026-05-07 Partial fix · 3.8.13, 3.8.10-4.el10_2 +47 CWE-170

TI-2026-04595 CVE-2026-5260 · GHSA-6hj5-4cv5-f46x

Gnutls: gnutls: information disclosure via heap overread in rsa key exchange

MEDIUM 43

A flaw was found in libgnutls.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00769 Published 2026-05-26 Partial fix · 3.8.10-4.el10_2, 3.8.9-9.el10_0.19 +44 CWE-126

TI-2026-30401 CVE-2026-42013 · GHSA-2pw7-g86g-76q7

Gnutls: gnutls: certificate validation bypass due to oversized subject alternative name

MEDIUM 42

A flaw was found in gnutls.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00423 Published 2026-05-26 Partial fix · 3.8.10-4.el10_2, 3.8.9-9.el10_0.19 +41 CWE-295

TI-2026-30397 CVE-2026-42009 · GHSA-9gx7-g5hv-xjjj

Gnutls: gnutls: denial of service via dtls packet reordering vulnerability

MEDIUM 42

A flaw was found in gnutls.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01335 Published 2026-05-18 Partial fix · 3.8.13, 3.8.10-4.el10_2 +48 CWE-475

TI-2026-26212 CVE-2026-33846 · GHSA-qcj7-gqxf-2cqq

Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassembly

MEDIUM 41

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01263 Published 2026-05-04 Partial fix · 3.8.10-4.el10_2, 3.8.9-9.el10_0.19 +44 CWE-130

TI-2026-30399 CVE-2026-42011 · GHSA-568w-37qx-3qc6

Gnutls: gnutls: security bypass due to incorrect name constraint handling

LOW 35

A flaw was found in gnutls.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00475 Published 2026-05-07 Partial fix · 3.8.10-4.el10_2, 3.8.9-9.el10_0.19 +41 CWE-295

TI-2024-11254 CVE-2024-12133 · GHSA-j3qr-8f3v-fgjj

Libtasn1: inefficient der decoding in libtasn1 leading to potential remote dos

LOW 32

A flaw in libtasn1 causes inefficient handling of specific certificate data.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0111 Published 2025-02-10 Partial fix · 4.20.0, 4.13-5.el8_10 +11 CWE-407

TI-2026-30403 CVE-2026-42015 · GHSA-45p2-c2m2-2656

Gnutls: gnutls: memory corruption due to off-by-one error in pkcs#12 bag handling

LOW 31

A flaw was found in gnutls.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00727 Published 2026-05-26 Partial fix · 3.8.10-4.el10_2, 3.8.9-9.el10_0.19 +33 CWE-193

TI-2026-30400 CVE-2026-42012 · GHSA-7hhj-8fwv-m5hc

Gnutls: gnutls: certificate validation bypass due to improper handling of uri and srv sans

LOW 31

A flaw was found in gnutls.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00374 Published 2026-05-26 Partial fix · 3.8.10-4.el10_2, 3.8.9-9.el10_0.19 +37 CWE-295

TI-2025-13528 CVE-2025-14831 · GHSA-pm8w-jq9r-x5rp

Gnutls: gnutls: denial of service via excessive resource consumption during certificate verification

LOW 31

A flaw was found in GnuTLS.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00656 Published 2026-02-09 Partial fix · 3.8.10-3.el10_1, 3.8.9-9.el10_0.17 +40 CWE-407

TI-2026-30402 CVE-2026-42014 · GHSA-m4m5-7xc2-xc7g

Gnutls: gnutls: use-after-free in gnutls_pkcs11_token_set_pin

LOW 28

A flaw was found in GnuTLS.

CVSS 3.1MEDIUM 6.6 Local Low privileges No interaction EPSS 0.0015 Published 2026-06-16 Partial fix · 3.8.10-4.el10_2, 3.8.9-9.el10_0.19 +33 CWE-825