Every CVE Search/ Get API key

CVE-2026-5419

Gnutls: gnutls: information disclosure via timing side-channel in pkcs#7 padding removal

3.7 LowFix available

A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.54%Up 0.5 points since Jun 2, 2026
90%50%10%1%

What each source reports

CVE List Score used 3.7

Gnutls: gnutls: information disclosure via timing side-channel in pkcs#7 padding removal

A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.

Record
CVE-2026-5419
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-208
Updated
2026-11-06
EUVDEUVD-2026-33755 3.7

A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.

Record
EUVD-2026-33755
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-06
GitHub AdvisoriesGHSA-6452-5wg5-m56r 3.7

A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not...

A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.

Record
GHSA-6452-5wg5-m56r
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-208
Updated
2026-11-02
NVD 3.7

A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.

Record
CVE-2026-5419
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-208
Updated
2026-11-06
OSVALPINE-CVE-2026-5419 3.7

A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.

Record
ALPINE-CVE-2026-5419
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVBELL-CVE-2026-5419 3.7
Record
BELL-CVE-2026-5419
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
Show 24 moreShow less
OSV 3.7

Gnutls: gnutls: information disclosure via timing side-channel in pkcs#7 padding removal

A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.

Record
CVE-2026-5419
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-208
Updated
2026-11-07
OSVDEBIAN-CVE-2026-5419 3.7

A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.

Record
DEBIAN-CVE-2026-5419
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-07
OSVOESA-2026-2333 9.8

gnutls security update

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, and other required structures. The project strives to provide a secure communications back-end, simple to use and integrated with the rest of the base Linux libraries. A back-end designed to work and be secure out of the box, keeping the complexity of TLS and PKI out of application code.

Security Fix(es):

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.(CVE-2026-33846)

A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of nameConstraints labels, specifically for dNSName (DNS) or rfc822Name (email) constraints within excludedSubtrees or permittedSubtrees. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.(CVE-2026-3833)

(CVE-2026-42009)

A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.(CVE-2026-42010)

(CVE-2026-42013)

(CVE-2026-42014)

(CVE-2026-42015)

(CVE-2026-5260)

(CVE-2026-5419)

Record
OESA-2026-2333
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-2334 9.8

gnutls security update

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, and other required structures. The project strives to provide a secure communications back-end, simple to use and integrated with the rest of the base Linux libraries. A back-end designed to work and be secure out of the box, keeping the complexity of TLS and PKI out of application code.

Security Fix(es):

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.(CVE-2026-33846)

A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of nameConstraints labels, specifically for dNSName (DNS) or rfc822Name (email) constraints within excludedSubtrees or permittedSubtrees. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.(CVE-2026-3833)

(CVE-2026-42009)

A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.(CVE-2026-42010)

(CVE-2026-42013)

(CVE-2026-42014)

(CVE-2026-42015)

(CVE-2026-5260)

(CVE-2026-5419)

Record
OESA-2026-2334
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-2335 9.8

gnutls security update

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, and other required structures. The project strives to provide a secure communications back-end, simple to use and integrated with the rest of the base Linux libraries. A back-end designed to work and be secure out of the box, keeping the complexity of TLS and PKI out of application code.

Security Fix(es):

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.(CVE-2026-33846)

A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of nameConstraints labels, specifically for dNSName (DNS) or rfc822Name (email) constraints within excludedSubtrees or permittedSubtrees. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.(CVE-2026-3833)

(CVE-2026-42009)

A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.(CVE-2026-42010)

(CVE-2026-42013)

(CVE-2026-42014)

(CVE-2026-42015)

(CVE-2026-5260)

(CVE-2026-5419)

Record
OESA-2026-2335
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:13274 8.2

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:13274
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:20612 8.2

Red Hat Security Advisory: gnutls security update

Record
RHSA-2026:20612
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:20613 8.2

Red Hat Security Advisory: gnutls security update

Record
RHSA-2026:20613
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:26409 8.2

Red Hat Security Advisory: gnutls security update

Record
RHSA-2026:26409
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:30004 8.2

Red Hat Security Advisory: gnutls security update

Record
RHSA-2026:30004
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:32962 8.2

Red Hat Security Advisory: gnutls security update

Record
RHSA-2026:32962
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:20612 8.2

Important: gnutls security update

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

Security Fix(es):

  • gnutls: Fix qsort comparator in DTLS reassembly (CVE-2026-42009)
  • gnutls: Fix crashing on an underflow with a DTLS datagram (CVE-2026-33845)
  • gnutls: Fix RSA-PSK identity truncation (CVE-2026-42010)
  • gnutls: Fix case-sensitivity of domain name comparison in name constraints (CVE-2026-3833)
  • gnutls: Fix intersecting empty name constraints (CVE-2026-42011)
  • gnutls: Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly (CVE-2026-33846)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:20612
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:20613 8.2

Important: gnutls security update

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

Security Fix(es):

  • gnutls: Fix qsort comparator in DTLS reassembly (CVE-2026-42009)
  • gnutls: Fix crashing on an underflow with a DTLS datagram (CVE-2026-33845)
  • gnutls: Fix RSA-PSK identity truncation (CVE-2026-42010)
  • gnutls: Fix case-sensitivity of domain name comparison in name constraints (CVE-2026-3833)
  • gnutls: Fix intersecting empty name constraints (CVE-2026-42011)
  • gnutls: Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly (CVE-2026-33846)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:20613
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-5419 3.7

A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.

Record
UBUNTU-CVE-2026-5419
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVALSA-2026:20612 No score

Important: gnutls security update

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library,
which implements cryptographic algorithms and protocols such as SSL, TLS, and
DTLS.

Security Fix(es):

  • gnutls: Fix qsort comparator in DTLS reassembly (CVE-2026-42009)
  • gnutls: Fix crashing on an underflow with a DTLS datagram

(CVE-2026-33845)

  • gnutls: Fix RSA-PSK identity truncation (CVE-2026-42010)
  • gnutls: Fix case-sensitivity of domain name comparison in name

constraints (CVE-2026-3833)

  • gnutls: Fix intersecting empty name constraints (CVE-2026-42011)
  • gnutls: Denial of Service via heap buffer overflow in DTLS handshake

fragment reassembly (CVE-2026-33846)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

Record
ALSA-2026:20612
Updated
2026-11-02
OSVALSA-2026:20613 No score

Important: gnutls security update

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library,
which implements cryptographic algorithms and protocols such as SSL, TLS, and
DTLS.

Security Fix(es):

  • gnutls: Fix qsort comparator in DTLS reassembly (CVE-2026-42009)
  • gnutls: Fix crashing on an underflow with a DTLS datagram (CVE-2026-33845)
  • gnutls: Fix RSA-PSK identity truncation (CVE-2026-42010)
  • gnutls: Fix case-sensitivity of domain name comparison in name constraints (CVE-2026-3833)
  • gnutls: Fix intersecting empty name constraints (CVE-2026-42011)
  • gnutls: Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly (CVE-2026-33846)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

Record
ALSA-2026:20613
Updated
2026-11-02
OSVAZL-89424 No score

CVE-2026-5419 affecting package gnutls for versions less than 3.8.13-1

A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.

Record
AZL-89424
Updated
2026-11-02
OSVopenSUSE-SU-2026:10691-1 No score

gnutls-3.8.13-1.1 on GA media

These are all security issues fixed in the gnutls-3.8.13-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10691-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20778-1 No score

Security update for gnutls

This update for gnutls fixes the following issues

  • CVE-2026-3832: cert-session: fix multi-entry OCSP revocation bypass (bsc#1263706).
  • CVE-2026-3833: x509/name-constraints: compare domain names case-insensitive (bsc#1263707).
  • CVE-2026-5260: lib/pkcs11_privkey: guard against overreading on short ciphertexts (bsc#1263715).
  • CVE-2026-5419: gnutls_cipher_decrypt3: make PKCS#7 unpadding branch free (bsc#1263716).
  • CVE-2026-33845: buffers: switch from end_offset over to frag_length (bsc#1263704).
  • CVE-2026-33846: buffers: add more checks to DTLS reassembly (bsc#1263705).
  • CVE-2026-42009: lib/buffers: ensure packets have differing sequence numbers (bsc#1263708).
  • CVE-2026-42010: lib/auth/rsa_psk: fix binary PSK identity lookup (bsc#1263709).
  • CVE-2026-42011: x509/name_constraints: fix intersecting empty constraints (bsc#1263710).
  • CVE-2026-42012: x509/hostname-verify: make URI/SRV SAN preclude CN fallback (bsc#1263711).
  • CVE-2026-42013: x509: prevent fallback on oversized SAN (bsc#1263712).
  • CVE-2026-42014: pkcs11_write: fix UAF and leak in gnutls_pkcs11_token_set_pin (bsc#1263713).
  • CVE-2026-42015: x509/pkcs12_bag: fix off-by-one in bag element bounds chec (bsc#1263714).
Record
openSUSE-SU-2026:20778-1
Updated
2026-11-02
OSVSUSE-SU-2026:2115-1 No score

Security update for gnutls

This update for gnutls fixes the following issues

  • CVE-2026-3833: x509/name-constraints: compare domain names case-insensitive (bsc#1263707).
  • CVE-2026-5260: lib/pkcs11_privkey: guard against overreading on short ciphertexts (bsc#1263715).
  • CVE-2026-5419: gnutls_cipher_decrypt3: make PKCS#7 unpadding branch free (bsc#1263716).
  • CVE-2026-33845: buffers: switch from end_offset over to frag_length (bsc#1263704).
  • CVE-2026-33846: buffers: add more checks to DTLS reassembly (bsc#1263705).
  • CVE-2026-42009: lib/buffers: ensure packets have differing sequence numbers (bsc#1263708).
  • CVE-2026-42010: lib/auth/rsa_psk: fix binary PSK identity lookup (bsc#1263709).
  • CVE-2026-42011: x509/name_constraints: fix intersecting empty constraints (bsc#1263710).
  • CVE-2026-42012: x509/hostname-verify: make URI/SRV SAN preclude CN fallback (bsc#1263711).
  • CVE-2026-42013: x509: prevent fallback on oversized SAN (bsc#1263712).
  • CVE-2026-42014: pkcs11_write: fix UAF and leak in gnutls_pkcs11_token_set_pin (bsc#1263713).
  • CVE-2026-42015: x509/pkcs12_bag: fix off-by-one in bag element bounds chec (bsc#1263714).
Record
SUSE-SU-2026:2115-1
Updated
2026-11-02
OSVSUSE-SU-2026:21752-1 No score

Security update for gnutls

This update for gnutls fixes the following issues

  • CVE-2026-3832: cert-session: fix multi-entry OCSP revocation bypass (bsc#1263706).
  • CVE-2026-3833: x509/name-constraints: compare domain names case-insensitive (bsc#1263707).
  • CVE-2026-5260: lib/pkcs11_privkey: guard against overreading on short ciphertexts (bsc#1263715).
  • CVE-2026-5419: gnutls_cipher_decrypt3: make PKCS#7 unpadding branch free (bsc#1263716).
  • CVE-2026-33845: buffers: switch from end_offset over to frag_length (bsc#1263704).
  • CVE-2026-33846: buffers: add more checks to DTLS reassembly (bsc#1263705).
  • CVE-2026-42009: lib/buffers: ensure packets have differing sequence numbers (bsc#1263708).
  • CVE-2026-42010: lib/auth/rsa_psk: fix binary PSK identity lookup (bsc#1263709).
  • CVE-2026-42011: x509/name_constraints: fix intersecting empty constraints (bsc#1263710).
  • CVE-2026-42012: x509/hostname-verify: make URI/SRV SAN preclude CN fallback (bsc#1263711).
  • CVE-2026-42013: x509: prevent fallback on oversized SAN (bsc#1263712).
  • CVE-2026-42014: pkcs11_write: fix UAF and leak in gnutls_pkcs11_token_set_pin (bsc#1263713).
  • CVE-2026-42015: x509/pkcs12_bag: fix off-by-one in bag element bounds chec (bsc#1263714).
Record
SUSE-SU-2026:21752-1
Updated
2026-11-02
OSVSUSE-SU-2026:21784-1 No score

Security update for gnutls

This update for gnutls fixes the following issues

  • CVE-2026-3833: x509/name-constraints: compare domain names case-insensitive (bsc#1263707).
  • CVE-2026-5260: lib/pkcs11_privkey: guard against overreading on short ciphertexts (bsc#1263715).
  • CVE-2026-5419: gnutls_cipher_decrypt3: make PKCS#7 unpadding branch free (bsc#1263716).
  • CVE-2026-33845: buffers: switch from end_offset over to frag_length (bsc#1263704).
  • CVE-2026-33846: buffers: add more checks to DTLS reassembly (bsc#1263705).
  • CVE-2026-42009: lib/buffers: ensure packets have differing sequence numbers (bsc#1263708).
  • CVE-2026-42010: lib/auth/rsa_psk: fix binary PSK identity lookup (bsc#1263709).
  • CVE-2026-42011: x509/name_constraints: fix intersecting empty constraints (bsc#1263710).
  • CVE-2026-42012: x509/hostname-verify: make URI/SRV SAN preclude CN fallback (bsc#1263711).
  • CVE-2026-42013: x509: prevent fallback on oversized SAN (bsc#1263712).
  • CVE-2026-42014: pkcs11_write: fix UAF and leak in gnutls_pkcs11_token_set_pin (bsc#1263713).
  • CVE-2026-42015: x509/pkcs12_bag: fix off-by-one in bag element bounds chec (bsc#1263714).
Record
SUSE-SU-2026:21784-1
Updated
2026-11-02
OSVSUSE-SU-2026:21815-1 No score

Security update for gnutls

This update for gnutls fixes the following issues

  • CVE-2026-3832: cert-session: fix multi-entry OCSP revocation bypass (bsc#1263706).
  • CVE-2026-3833: x509/name-constraints: compare domain names case-insensitive (bsc#1263707).
  • CVE-2026-5260: lib/pkcs11_privkey: guard against overreading on short ciphertexts (bsc#1263715).
  • CVE-2026-5419: gnutls_cipher_decrypt3: make PKCS#7 unpadding branch free (bsc#1263716).
  • CVE-2026-33845: buffers: switch from end_offset over to frag_length (bsc#1263704).
  • CVE-2026-33846: buffers: add more checks to DTLS reassembly (bsc#1263705).
  • CVE-2026-42009: lib/buffers: ensure packets have differing sequence numbers (bsc#1263708).
  • CVE-2026-42010: lib/auth/rsa_psk: fix binary PSK identity lookup (bsc#1263709).
  • CVE-2026-42011: x509/name_constraints: fix intersecting empty constraints (bsc#1263710).
  • CVE-2026-42012: x509/hostname-verify: make URI/SRV SAN preclude CN fallback (bsc#1263711).
  • CVE-2026-42013: x509: prevent fallback on oversized SAN (bsc#1263712).
  • CVE-2026-42014: pkcs11_write: fix UAF and leak in gnutls_pkcs11_token_set_pin (bsc#1263713).
  • CVE-2026-42015: x509/pkcs12_bag: fix off-by-one in bag element bounds chec (bsc#1263714).
Record
SUSE-SU-2026:21815-1
Updated
2026-11-02
OSVSUSE-SU-2026:21867-1 No score

Security update for gnutls

This update for gnutls fixes the following issues

  • CVE-2026-3833: x509/name-constraints: compare domain names case-insensitive (bsc#1263707).
  • CVE-2026-5260: lib/pkcs11_privkey: guard against overreading on short ciphertexts (bsc#1263715).
  • CVE-2026-5419: gnutls_cipher_decrypt3: make PKCS#7 unpadding branch free (bsc#1263716).
  • CVE-2026-33845: buffers: switch from end_offset over to frag_length (bsc#1263704).
  • CVE-2026-33846: buffers: add more checks to DTLS reassembly (bsc#1263705).
  • CVE-2026-42009: lib/buffers: ensure packets have differing sequence numbers (bsc#1263708).
  • CVE-2026-42010: lib/auth/rsa_psk: fix binary PSK identity lookup (bsc#1263709).
  • CVE-2026-42011: x509/name_constraints: fix intersecting empty constraints (bsc#1263710).
  • CVE-2026-42012: x509/hostname-verify: make URI/SRV SAN preclude CN fallback (bsc#1263711).
  • CVE-2026-42013: x509: prevent fallback on oversized SAN (bsc#1263712).
  • CVE-2026-42014: pkcs11_write: fix UAF and leak in gnutls_pkcs11_token_set_pin (bsc#1263713).
  • CVE-2026-42015: x509/pkcs12_bag: fix off-by-one in bag element bounds chec (bsc#1263714).
Record
SUSE-SU-2026:21867-1
Updated
2026-11-02

Affected products

Show 5 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
gnutls
Alpine:v3.20
 before 3.8.13-r0
3.8.13-r0
gnutls
Alpine:v3.21
 before 3.8.13-r0
3.8.13-r0
gnutls
Alpine:v3.22
 before 3.8.13-r0
3.8.13-r0
gnutls
Alpine:v3.23
 before 3.8.13-r0
3.8.13-r0
gnutls
Alpine:v3.24
 before 3.8.13-r0
3.8.13-r0
gnutls
AlmaLinux:9
From an advisory covering 13 CVEs
 before 3.8.10-4.el9_8
3.8.10-4.el9_8
gnutls-c++
AlmaLinux:9
From an advisory covering 13 CVEs
 before 3.8.10-4.el9_8
3.8.10-4.el9_8
gnutls-dane
AlmaLinux:9
From an advisory covering 13 CVEs
 before 3.8.10-4.el9_8
3.8.10-4.el9_8
gnutls-devel
AlmaLinux:9
From an advisory covering 13 CVEs
 before 3.8.10-4.el9_8
3.8.10-4.el9_8
gnutls-utils
AlmaLinux:9
From an advisory covering 13 CVEs
 before 3.8.10-4.el9_8
3.8.10-4.el9_8
Show 94 moreShow less
Affected packages
PackageAffectedFixed
gnutls
AlmaLinux:10
From an advisory covering 13 CVEs
 before 3.8.10-4.el10_2
3.8.10-4.el10_2
gnutls-c++
AlmaLinux:10
From an advisory covering 13 CVEs
 before 3.8.10-4.el10_2
3.8.10-4.el10_2
gnutls-dane
AlmaLinux:10
From an advisory covering 13 CVEs
 before 3.8.10-4.el10_2
3.8.10-4.el10_2
gnutls-devel
AlmaLinux:10
From an advisory covering 13 CVEs
 before 3.8.10-4.el10_2
3.8.10-4.el10_2
gnutls-fips
AlmaLinux:10
From an advisory covering 13 CVEs
 before 3.8.10-4.el10_2
3.8.10-4.el10_2
gnutls-utils
AlmaLinux:10
From an advisory covering 13 CVEs
 before 3.8.10-4.el10_2
3.8.10-4.el10_2
gnutls
Azure Linux:3
 before 3.8.13-1
3.8.13-1
gnutls
Alpaquita:23
 3.7.8-r2 up to 3.8.13-r0
3.8.13-r0
gnutls
Alpaquita:25
 3.8.8-r0 up to 3.8.13-r0
3.8.13-r0
gnutls
Alpaquita:stream
 3.8.0-r3 up to 3.8.13-r0
3.8.13-r0
gnutls28
Debian:12
 before 3.7.9-2+deb12u7, plus listed versions
3.7.9-23.7.9-2+deb12u13.7.9-2+deb12u23.7.9-2+deb12u33.7.9-2+deb12u43.7.9-2+deb12u53.7.9-2+deb12u6
3.7.9-2+deb12u7
gnutls28
Debian:13
 before 3.8.9-3+deb13u4, plus listed versions
3.8.9-33.8.9-3+deb13u13.8.9-3+deb13u23.8.9-3+deb13u3
3.8.9-3+deb13u4
gnutls28
Debian:14
 before 3.8.13-1, plus listed versions
3.8.10-13.8.10-23.8.10-33.8.11-13.8.11-2
Show 6 moreShow less
3.8.11-33.8.12-13.8.12-23.8.12-33.8.12-43.8.9-3
3.8.13-1
gnutls
openEuler:24.03-LTS
From an advisory covering 9 CVEs
 before 3.8.2-14.oe2403
3.8.2-14.oe2403
gnutls
openEuler:24.03-LTS-SP1
From an advisory covering 9 CVEs
 before 3.8.2-14.oe2403sp1
3.8.2-14.oe2403sp1
gnutls
openEuler:24.03-LTS-SP3
From an advisory covering 9 CVEs
 before 3.8.2-14.oe2403sp3
3.8.2-14.oe2403sp3
gnutls
Red Hat:hummingbird:1
From an advisory covering 13 CVEs
 before 0:3.8.13-1.hum1
0:3.8.13-1.hum1
gnutls-c++
Red Hat:hummingbird:1
From an advisory covering 13 CVEs
 before 0:3.8.13-1.hum1
0:3.8.13-1.hum1
gnutls-dane
Red Hat:hummingbird:1
From an advisory covering 13 CVEs
 before 0:3.8.13-1.hum1
0:3.8.13-1.hum1
gnutls-devel
Red Hat:hummingbird:1
From an advisory covering 13 CVEs
 before 0:3.8.13-1.hum1
0:3.8.13-1.hum1
gnutls-fips
Red Hat:hummingbird:1
From an advisory covering 13 CVEs
 before 0:3.8.13-1.hum1
0:3.8.13-1.hum1
gnutls-utils
Red Hat:hummingbird:1
From an advisory covering 13 CVEs
 before 0:3.8.13-1.hum1
0:3.8.13-1.hum1
mingw32-gnutls
Red Hat:hummingbird:1
From an advisory covering 13 CVEs
 before 0:3.8.13-1.hum1
0:3.8.13-1.hum1
mingw64-gnutls
Red Hat:hummingbird:1
From an advisory covering 13 CVEs
 before 0:3.8.13-1.hum1
0:3.8.13-1.hum1
gnutls-c++
Red Hat:enterprise_linux:9::appstream
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el9_8
0:3.8.10-4.el9_8
gnutls-c++-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el9_8
0:3.8.10-4.el9_8
gnutls-dane
Red Hat:enterprise_linux:9::appstream
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el9_8
0:3.8.10-4.el9_8
gnutls-dane-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el9_8
0:3.8.10-4.el9_8
gnutls-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el9_8
0:3.8.10-4.el9_8
gnutls-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el9_8
0:3.8.10-4.el9_8
gnutls-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el9_8
0:3.8.10-4.el9_8
gnutls-utils
Red Hat:enterprise_linux:9::appstream
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el9_8
0:3.8.10-4.el9_8
gnutls-utils-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el9_8
0:3.8.10-4.el9_8
gnutls
Red Hat:enterprise_linux:9::baseos
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el9_8
0:3.8.10-4.el9_8
gnutls-c++-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el9_8
0:3.8.10-4.el9_8
gnutls-dane-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el9_8
0:3.8.10-4.el9_8
gnutls-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el9_8
0:3.8.10-4.el9_8
gnutls-debugsource
Red Hat:enterprise_linux:9::baseos
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el9_8
0:3.8.10-4.el9_8
gnutls-utils-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el9_8
0:3.8.10-4.el9_8
gnutls-c++
Red Hat:enterprise_linux:10.2
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el10_2
0:3.8.10-4.el10_2
gnutls-c++-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el10_2
0:3.8.10-4.el10_2
gnutls-dane
Red Hat:enterprise_linux:10.2
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el10_2
0:3.8.10-4.el10_2
gnutls-dane-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el10_2
0:3.8.10-4.el10_2
gnutls-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el10_2
0:3.8.10-4.el10_2
gnutls-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el10_2
0:3.8.10-4.el10_2
gnutls-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el10_2
0:3.8.10-4.el10_2
gnutls-fips
Red Hat:enterprise_linux:10.2
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el10_2
0:3.8.10-4.el10_2
gnutls-utils
Red Hat:enterprise_linux:10.2
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el10_2
0:3.8.10-4.el10_2
gnutls-utils-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el10_2
0:3.8.10-4.el10_2
gnutls
Red Hat:enterprise_linux:10.2
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el10_2
0:3.8.10-4.el10_2
gnutls-c++
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 0:3.8.9-9.el10_0.19
0:3.8.9-9.el10_0.19
gnutls-dane
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 0:3.8.9-9.el10_0.19
0:3.8.9-9.el10_0.19
gnutls-dane-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 0:3.8.9-9.el10_0.19
0:3.8.9-9.el10_0.19
gnutls-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 0:3.8.9-9.el10_0.19
0:3.8.9-9.el10_0.19
gnutls-debugsource
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 0:3.8.9-9.el10_0.19
0:3.8.9-9.el10_0.19
gnutls-devel
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 0:3.8.9-9.el10_0.19
0:3.8.9-9.el10_0.19
gnutls-fips
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 0:3.8.9-9.el10_0.19
0:3.8.9-9.el10_0.19
gnutls-utils
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 0:3.8.9-9.el10_0.19
0:3.8.9-9.el10_0.19
gnutls-utils-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 0:3.8.9-9.el10_0.19
0:3.8.9-9.el10_0.19
gnutls
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 0:3.8.9-9.el10_0.19
0:3.8.9-9.el10_0.19
gnutls-c++-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 0:3.8.9-9.el10_0.19
0:3.8.9-9.el10_0.19
gnutls-c++
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 12 CVEs
 before 0:3.8.3-6.el9_6.4
0:3.8.3-6.el9_6.4
gnutls-dane
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 12 CVEs
 before 0:3.8.3-6.el9_6.4
0:3.8.3-6.el9_6.4
gnutls-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 12 CVEs
 before 0:3.8.3-6.el9_6.4
0:3.8.3-6.el9_6.4
gnutls-debugsource
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 12 CVEs
 before 0:3.8.3-6.el9_6.4
0:3.8.3-6.el9_6.4
gnutls-devel
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 12 CVEs
 before 0:3.8.3-6.el9_6.4
0:3.8.3-6.el9_6.4
gnutls-utils
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 12 CVEs
 before 0:3.8.3-6.el9_6.4
0:3.8.3-6.el9_6.4
gnutls-utils-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 12 CVEs
 before 0:3.8.3-6.el9_6.4
0:3.8.3-6.el9_6.4
gnutls
Red Hat:rhel_eus:9.6::baseos
From an advisory covering 12 CVEs
 before 0:3.8.3-6.el9_6.4
0:3.8.3-6.el9_6.4
gnutls-debuginfo
Red Hat:rhel_eus:9.6::baseos
From an advisory covering 12 CVEs
 before 0:3.8.3-6.el9_6.4
0:3.8.3-6.el9_6.4
gnutls-debugsource
Red Hat:rhel_eus:9.6::baseos
From an advisory covering 12 CVEs
 before 0:3.8.3-6.el9_6.4
0:3.8.3-6.el9_6.4
gnutls-utils-debuginfo
Red Hat:rhel_eus:9.6::baseos
From an advisory covering 12 CVEs
 before 0:3.8.3-6.el9_6.4
0:3.8.3-6.el9_6.4
gnutls-c++
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 12 CVEs
 before 0:3.8.3-4.el9_4.6
0:3.8.3-4.el9_4.6
gnutls-c++-debuginfo
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 12 CVEs
 before 0:3.8.3-4.el9_4.6
0:3.8.3-4.el9_4.6
gnutls-dane
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 12 CVEs
 before 0:3.8.3-4.el9_4.6
0:3.8.3-4.el9_4.6
gnutls-dane-debuginfo
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 12 CVEs
 before 0:3.8.3-4.el9_4.6
0:3.8.3-4.el9_4.6
gnutls-debuginfo
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 12 CVEs
 before 0:3.8.3-4.el9_4.6
0:3.8.3-4.el9_4.6
gnutls-debugsource
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 12 CVEs
 before 0:3.8.3-4.el9_4.6
0:3.8.3-4.el9_4.6
gnutls-devel
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 12 CVEs
 before 0:3.8.3-4.el9_4.6
0:3.8.3-4.el9_4.6
gnutls-utils
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 12 CVEs
 before 0:3.8.3-4.el9_4.6
0:3.8.3-4.el9_4.6
gnutls-utils-debuginfo
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 12 CVEs
 before 0:3.8.3-4.el9_4.6
0:3.8.3-4.el9_4.6
gnutls
Red Hat:rhel_e4s:9.4::baseos
From an advisory covering 12 CVEs
 before 0:3.8.3-4.el9_4.6
0:3.8.3-4.el9_4.6
gnutls-c++-debuginfo
Red Hat:rhel_e4s:9.4::baseos
From an advisory covering 12 CVEs
 before 0:3.8.3-4.el9_4.6
0:3.8.3-4.el9_4.6
gnutls-dane-debuginfo
Red Hat:rhel_e4s:9.4::baseos
From an advisory covering 12 CVEs
 before 0:3.8.3-4.el9_4.6
0:3.8.3-4.el9_4.6
gnutls-debuginfo
Red Hat:rhel_e4s:9.4::baseos
From an advisory covering 12 CVEs
 before 0:3.8.3-4.el9_4.6
0:3.8.3-4.el9_4.6
gnutls-debugsource
Red Hat:rhel_e4s:9.4::baseos
From an advisory covering 12 CVEs
 before 0:3.8.3-4.el9_4.6
0:3.8.3-4.el9_4.6
gnutls-utils-debuginfo
Red Hat:rhel_e4s:9.4::baseos
From an advisory covering 12 CVEs
 before 0:3.8.3-4.el9_4.6
0:3.8.3-4.el9_4.6
gnutls
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el9_8
0:3.8.10-4.el9_8
gnutls
Rocky Linux:10
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el10_2
0:3.8.10-4.el10_2
gnutls28
Ubuntu:24.04:LTS
 before 3.8.3-1.1ubuntu3.6, plus listed versions
3.8.1-4ubuntu13.8.1-4ubuntu63.8.1-4ubuntu73.8.3-1ubuntu13.8.3-1.1ubuntu2
Show 6 moreShow less
3.8.3-1.1ubuntu33.8.3-1.1ubuntu3.13.8.3-1.1ubuntu3.23.8.3-1.1ubuntu3.33.8.3-1.1ubuntu3.43.8.3-1.1ubuntu3.5
3.8.3-1.1ubuntu3.6
gnutls28
Ubuntu:Pro:FIPS-updates:24.04:LTS
 before 3.8.3-1.1ubuntu3.6+Fips1.2, plus listed versions
3.8.3-1.1ubuntu3.1+Fips13.8.3-1.1ubuntu3.4+Fips13.8.3-1.1ubuntu3.4+Fips1.13.8.3-1.1ubuntu3.5+Fips1.1
3.8.3-1.1ubuntu3.6+Fips1.2
gnutls28
Ubuntu:25.10
 before 3.8.9-3ubuntu2.2, plus listed versions
3.8.9-2ubuntu33.8.9-3ubuntu13.8.9-3ubuntu23.8.9-3ubuntu2.1
3.8.9-3ubuntu2.2
gnutls28
Ubuntu:26.04:LTS
 before 3.8.12-2ubuntu1.1, plus listed versions
3.8.9-3ubuntu23.8.10-3ubuntu13.8.12-2ubuntu1
3.8.12-2ubuntu1.1
gnutls
openSUSE:Tumbleweed
From an advisory covering 13 CVEs
 before 3.8.13-1.1
3.8.13-1.1

History

History
RecordedChangedSources
affectedEUVD, NVD, OSV
facts, productsCVE List
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-5419 is a low vulnerability (CVSS 3.7) in Red Hat Cert Manager Support For Red Hat Openshift Release 1.17, published April 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.54%, the 45th percentile. Fixed in gnutls 3.8.13-r0.

References

Show 130 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open