Every CVE Search/ Get API key

CVE-2026-33846

Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassembly

7.5 HighFix available

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.26%Up 1.2 points since May 4, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassembly

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.

Record
CVE-2026-33846
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-130, CWE-130
Updated
2026-11-04
EUVDEUVD-2026-26926 7.5

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.

Record
EUVD-2026-26926
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-04
GitHub AdvisoriesGHSA-qcj7-gqxf-2cqq 7.5

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of...

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.

Record
GHSA-qcj7-gqxf-2cqq
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-130
Updated
2026-11-02
NVD 7.5

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.

Record
CVE-2026-33846
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-130
Updated
2026-11-05
OSVALPINE-CVE-2026-33846 7.5

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.

Record
ALPINE-CVE-2026-33846
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBELL-CVE-2026-33846 7.5
Record
BELL-CVE-2026-33846
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 48 moreShow less
OSVDEBIAN-CVE-2026-33846 7.5

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.

Record
DEBIAN-CVE-2026-33846
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-05
OSVOESA-2026-2331 7.5

gnutls security update

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, and other required structures. The project strives to provide a secure communications back-end, simple to use and integrated with the rest of the base Linux libraries. A back-end designed to work and be secure out of the box, keeping the complexity of TLS and PKI out of application code.

Security Fix(es):

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.(CVE-2026-33846)

Record
OESA-2026-2331
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2332 7.5

gnutls security update

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, and other required structures. The project strives to provide a secure communications back-end, simple to use and integrated with the rest of the base Linux libraries. A back-end designed to work and be secure out of the box, keeping the complexity of TLS and PKI out of application code.

Security Fix(es):

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.(CVE-2026-33846)

Record
OESA-2026-2332
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2333 9.8

gnutls security update

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, and other required structures. The project strives to provide a secure communications back-end, simple to use and integrated with the rest of the base Linux libraries. A back-end designed to work and be secure out of the box, keeping the complexity of TLS and PKI out of application code.

Security Fix(es):

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.(CVE-2026-33846)

A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of nameConstraints labels, specifically for dNSName (DNS) or rfc822Name (email) constraints within excludedSubtrees or permittedSubtrees. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.(CVE-2026-3833)

(CVE-2026-42009)

A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.(CVE-2026-42010)

(CVE-2026-42013)

(CVE-2026-42014)

(CVE-2026-42015)

(CVE-2026-5260)

(CVE-2026-5419)

Record
OESA-2026-2333
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-2334 9.8

gnutls security update

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, and other required structures. The project strives to provide a secure communications back-end, simple to use and integrated with the rest of the base Linux libraries. A back-end designed to work and be secure out of the box, keeping the complexity of TLS and PKI out of application code.

Security Fix(es):

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.(CVE-2026-33846)

A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of nameConstraints labels, specifically for dNSName (DNS) or rfc822Name (email) constraints within excludedSubtrees or permittedSubtrees. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.(CVE-2026-3833)

(CVE-2026-42009)

A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.(CVE-2026-42010)

(CVE-2026-42013)

(CVE-2026-42014)

(CVE-2026-42015)

(CVE-2026-5260)

(CVE-2026-5419)

Record
OESA-2026-2334
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-2335 9.8

gnutls security update

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, and other required structures. The project strives to provide a secure communications back-end, simple to use and integrated with the rest of the base Linux libraries. A back-end designed to work and be secure out of the box, keeping the complexity of TLS and PKI out of application code.

Security Fix(es):

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.(CVE-2026-33846)

A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of nameConstraints labels, specifically for dNSName (DNS) or rfc822Name (email) constraints within excludedSubtrees or permittedSubtrees. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.(CVE-2026-3833)

(CVE-2026-42009)

A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.(CVE-2026-42010)

(CVE-2026-42013)

(CVE-2026-42014)

(CVE-2026-42015)

(CVE-2026-5260)

(CVE-2026-5419)

Record
OESA-2026-2335
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:13274 8.2

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:13274
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:20611 8.2

Red Hat Security Advisory: gnutls security update

Record
RHSA-2026:20611
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:20612 8.2

Red Hat Security Advisory: gnutls security update

Record
RHSA-2026:20612
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:20613 8.2

Red Hat Security Advisory: gnutls security update

Record
RHSA-2026:20613
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:26409 8.2

Red Hat Security Advisory: gnutls security update

Record
RHSA-2026:26409
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:30004 8.2

Red Hat Security Advisory: gnutls security update

Record
RHSA-2026:30004
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:30849 8.2

Red Hat Security Advisory: gnutls and libtasn1 security update

Record
RHSA-2026:30849
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:30850 8.2

Red Hat Security Advisory: gnutls and libtasn1 security update

Record
RHSA-2026:30850
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:32962 8.2

Red Hat Security Advisory: gnutls security update

Record
RHSA-2026:32962
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:33125 8.2

Red Hat Security Advisory: gnutls and libtasn1 security update

Record
RHSA-2026:33125
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:34372 7.5

Red Hat Security Advisory: gnutls security update

Record
RHSA-2026:34372
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:41921 8.2

Red Hat Security Advisory: gnutls security update

Record
RHSA-2026:41921
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:20611 8.2

Important: gnutls security update

Please update the gnutls packages to provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

Security Fix(es):

  • gnutls: Add more checks to DTLS reassembly (CVE-2026-33846)
  • gnutls: Fix qsort comparator in DTLS reassembly (CVE-2026-42009)
  • gnutls: Fix crashing on an underflow with a DTLS datagram (CVE-2026-33845)
  • gnutls: Fix RSA-PSK identity truncation (CVE-2026-42010)
  • gnutls: Fix case-sensitivity of domain name comparison in name constraints (CVE-2026-3833)
  • gnutls: Fix intersecting empty constraints (CVE-2026-42011)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:20611
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:20612 8.2

Important: gnutls security update

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

Security Fix(es):

  • gnutls: Fix qsort comparator in DTLS reassembly (CVE-2026-42009)
  • gnutls: Fix crashing on an underflow with a DTLS datagram (CVE-2026-33845)
  • gnutls: Fix RSA-PSK identity truncation (CVE-2026-42010)
  • gnutls: Fix case-sensitivity of domain name comparison in name constraints (CVE-2026-3833)
  • gnutls: Fix intersecting empty name constraints (CVE-2026-42011)
  • gnutls: Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly (CVE-2026-33846)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:20612
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:20613 8.2

Important: gnutls security update

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

Security Fix(es):

  • gnutls: Fix qsort comparator in DTLS reassembly (CVE-2026-42009)
  • gnutls: Fix crashing on an underflow with a DTLS datagram (CVE-2026-33845)
  • gnutls: Fix RSA-PSK identity truncation (CVE-2026-42010)
  • gnutls: Fix case-sensitivity of domain name comparison in name constraints (CVE-2026-3833)
  • gnutls: Fix intersecting empty name constraints (CVE-2026-42011)
  • gnutls: Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly (CVE-2026-33846)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:20613
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-33846 7.5

CVE-2026-33846 in rootio-gnutls28 - Patched by Root

Root has patched CVE-2026-33846 in the rootio-gnutls28 package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2026-33846
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-33846 7.5

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.

Record
UBUNTU-CVE-2026-33846
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:20611 No score

Important: gnutls security update

Please update the gnutls packages to provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

Security Fix(es):

  • gnutls: Add more checks to DTLS reassembly (CVE-2026-33846)
  • gnutls: Fix qsort comparator in DTLS reassembly (CVE-2026-42009)
  • gnutls: Fix crashing on an underflow with a DTLS datagram (CVE-2026-33845)
  • gnutls: Fix RSA-PSK identity truncation (CVE-2026-42010)
  • gnutls: Fix case-sensitivity of domain name comparison in name constraints (CVE-2026-3833)
  • gnutls: Fix intersecting empty constraints (CVE-2026-42011)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:20611
Updated
2026-11-02
OSVALSA-2026:20612 No score

Important: gnutls security update

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library,
which implements cryptographic algorithms and protocols such as SSL, TLS, and
DTLS.

Security Fix(es):

  • gnutls: Fix qsort comparator in DTLS reassembly (CVE-2026-42009)
  • gnutls: Fix crashing on an underflow with a DTLS datagram

(CVE-2026-33845)

  • gnutls: Fix RSA-PSK identity truncation (CVE-2026-42010)
  • gnutls: Fix case-sensitivity of domain name comparison in name

constraints (CVE-2026-3833)

  • gnutls: Fix intersecting empty name constraints (CVE-2026-42011)
  • gnutls: Denial of Service via heap buffer overflow in DTLS handshake

fragment reassembly (CVE-2026-33846)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

Record
ALSA-2026:20612
Updated
2026-11-02
OSVALSA-2026:20613 No score

Important: gnutls security update

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library,
which implements cryptographic algorithms and protocols such as SSL, TLS, and
DTLS.

Security Fix(es):

  • gnutls: Fix qsort comparator in DTLS reassembly (CVE-2026-42009)
  • gnutls: Fix crashing on an underflow with a DTLS datagram (CVE-2026-33845)
  • gnutls: Fix RSA-PSK identity truncation (CVE-2026-42010)
  • gnutls: Fix case-sensitivity of domain name comparison in name constraints (CVE-2026-3833)
  • gnutls: Fix intersecting empty name constraints (CVE-2026-42011)
  • gnutls: Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly (CVE-2026-33846)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

Record
ALSA-2026:20613
Updated
2026-11-02
OSVAZL-86220 No score

CVE-2026-33846 affecting package gnutls for versions less than 3.8.3-11

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.

Record
AZL-86220
Updated
2026-11-02
OSVCLSA-2026-1780068674 No score

gnutls: Fix of 8 CVEs

  • CVE-2026-33846: DTLS handshake reassembly add more checks (buffers.c)
  • CVE-2026-42009: DTLS reorder qsort with duplicate sequence numbers
  • CVE-2026-42011: X.509 name constraints intersection of empty constraints
  • CVE-2026-42012: URI/SRV SAN preclude CN fallback
  • CVE-2026-42013: prevent fallback on oversized SAN
  • CVE-2026-42014: PKCS#11 token set_pin UAF + leak
  • CVE-2026-5260: PKCS#11 RSA short-ciphertext overread; ciphertext must match modulus size
  • CVE-2026-42015: PKCS#12 bag-element off-by-one bound check
Record
CLSA-2026-1780068674
Updated
2026-11-02
OSVCLSA-2026-1780069034 No score

gnutls: Fix of 8 CVEs

  • CVE-2026-33846: DTLS handshake reassembly add more checks (buffers.c)
  • CVE-2026-42009: DTLS reorder qsort with duplicate sequence numbers
  • CVE-2026-42011: X.509 name constraints intersection of empty constraints
  • CVE-2026-42012: URI/SRV SAN preclude CN fallback
  • CVE-2026-42013: prevent fallback on oversized SAN
  • CVE-2026-42014: PKCS#11 token set_pin UAF + leak
  • CVE-2026-5260: PKCS#11 RSA short-ciphertext overread; ciphertext must match modulus size
  • CVE-2026-42015: PKCS#12 bag-element off-by-one bound check
Record
CLSA-2026-1780069034
Updated
2026-11-02
OSVCLSA-2026-1780389355 No score

gnutls: Fix of 7 CVEs

  • CVE-2026-33846: fix heap buffer overflow in DTLS handshake fragment reassembly by validating message-length consistency and bounding the fragment write against the destination buffer capacity
  • CVE-2026-42009: fix undefined behaviour in DTLS packet ordering by making the handshake_compare qsort comparator return 0 for equal sequence numbers
  • CVE-2026-42011: fix name constraints bypass by no longer short-circuiting the intersection of an empty permitted set, so later permitted constraints are still enforced
  • CVE-2026-42012: fix certificate verification bypass by making URI and SRV subjectAltName entries preclude the legacy CN fallback hostname check
  • CVE-2026-42013: fix certificate verification bypass by preventing CN and DN-email fallback when a subjectAltName entry is oversized
  • CVE-2026-5260: fix heap overread in RSA key exchange by rejecting a ciphertext whose size does not match the RSA modulus
  • CVE-2026-42014: fix use-after-free and leak in gnutls_pkcs11_token_set_pin when changing the security officer PIN
Record
CLSA-2026-1780389355
Updated
2026-11-02
OSVCLSA-2026-1780484200 No score

gnutls: Fix of 8 CVEs

  • CVE-2026-33846: fix heap buffer overflow in DTLS handshake fragment reassembly by validating message-length consistency and bounding the fragment write against the destination buffer capacity
  • CVE-2026-42009: fix undefined behaviour in DTLS packet ordering by making the handshake_compare qsort comparator return 0 for equal sequence numbers
  • CVE-2026-42011: fix name constraints bypass by no longer short-circuiting the intersection of an empty permitted set, so later permitted constraints are still enforced
  • CVE-2026-42012: fix certificate verification bypass by making URI and SRV subjectAltName entries preclude the legacy CN fallback hostname check
  • CVE-2026-42013: fix certificate verification bypass by preventing CN and DN-email fallback when a subjectAltName entry is oversized
  • CVE-2026-5260: fix heap overread in RSA key exchange by rejecting a ciphertext whose size does not match the RSA modulus
  • CVE-2026-42014: fix use-after-free and leak in gnutls_pkcs11_token_set_pin when changing the security officer PIN
  • CVE-2026-42015: fix off-by-one out-of-bounds write when appending an element to a PKCS#12 bag that already holds the maximum number of elements
Record
CLSA-2026-1780484200
Updated
2026-11-02
OSVCLSA-2026-1780925342 No score

gnutls: Fix of 5 CVEs

  • CVE-2026-42009: fix DTLS handshake_compare qsort comparator contract violation (undefined behaviour)
  • CVE-2026-33846: add DTLS reassembly fragment length/bounds checks (heap overwrite)
  • CVE-2026-42012: URI subjectAltName now precludes Common Name fallback in hostname verification
  • CVE-2026-42013: oversized subjectAltName now precludes Common Name fallback in hostname verification
  • CVE-2026-5260: guard PKCS#11 RSA decryption against short-ciphertext heap overread
Record
CLSA-2026-1780925342
Updated
2026-11-02
OSVCLSA-2026-1783520053 No score

gnutls: Fix of CVE-2026-42009

  • CVE-2026-42009: fix DTLS handshake_compare qsort comparator contract violation (undefined behaviour)
  • CVE-2026-33846: add DTLS reassembly fragment length/bounds checks (heap overwrite)
  • CVE-2026-42012: URI subjectAltName now precludes Common Name fallback in hostname verification
  • CVE-2026-42013: oversized subjectAltName now precludes Common Name fallback in hostname verification
  • CVE-2026-5260: guard PKCS#11 RSA decryption against short-ciphertext heap overread
Record
CLSA-2026-1783520053
Updated
2026-11-02
OSVCLSA-2026-1783689031 No score

Fix CVE(s): CVE-2026-33846, CVE-2026-42009, CVE-2026-5260

  • SECURITY UPDATE: heap buffer overflow in DTLS handshake reassembly
    • debian/patches/CVE-2026-33846.patch: add length-consistency and array bounds checks in merge_handshake_packet in lib/buffers.c to reject DTLS fragments with mismatching or oversized claimed length
    • CVE-2026-33846
  • SECURITY UPDATE: denial of service via non-conforming qsort comparator
    • debian/patches/CVE-2026-42009.patch: return 0 for equal sequence numbers in handshake_compare in lib/buffers.c so DTLS packet ordering follows the qsort strict-weak-ordering contract
    • CVE-2026-42009
  • SECURITY UPDATE: heap over-read on short RSA ciphertext with PKCS#11 key
    • debian/patches/CVE-2026-5260.patch: verify ciphertext size matches the RSA modulus in proc_rsa_client_kx and _gnutls_proc_rsa_psk_client_kx (lib/auth/rsa.c, lib/auth/rsa_psk.c) and size the PKCS#11 decrypt buffer with MAX(siglen, plaintext_size) in lib/pkcs11_privkey.c
    • CVE-2026-5260
Record
CLSA-2026-1783689031
Updated
2026-11-02
OSVCLSA-2026-1784018158 No score

Fix CVE(s): CVE-2026-33846, CVE-2026-42009, CVE-2026-5260

  • SECURITY UPDATE: heap buffer overflow in DTLS handshake reassembly
    • debian/patches/CVE-2026-33846.patch: add length-consistency and array bounds checks in merge_handshake_packet in lib/buffers.c to reject DTLS fragments with mismatching or oversized claimed length
    • CVE-2026-33846
  • SECURITY UPDATE: denial of service via non-conforming qsort comparator
    • debian/patches/CVE-2026-42009.patch: return 0 for equal sequence numbers in handshake_compare in lib/buffers.c so DTLS packet ordering follows the qsort strict-weak-ordering contract
    • CVE-2026-42009
  • SECURITY UPDATE: heap over-read on short RSA-PSK ciphertext with PKCS#11 key
    • debian/patches/CVE-2026-5260.patch: verify ciphertext size matches the RSA modulus in _gnutls_proc_rsa_psk_client_kx in lib/auth/rsa_psk.c and size the PKCS#11 decrypt buffer with MAX(siglen, plaintext_size) in lib/pkcs11_privkey.c (the RSA path uses the allocating decrypt API and is not affected)
    • CVE-2026-5260
Record
CLSA-2026-1784018158
Updated
2026-11-02
OSVCLSA-2026-1784018375 No score

Fix CVE(s): CVE-2026-33846, CVE-2026-42009

  • SECURITY UPDATE: heap buffer overflow in DTLS handshake reassembly
    • debian/patches/CVE-2026-33846.patch: add length-consistency and array bounds checks in merge_handshake_packet in lib/gnutls_buffers.c to reject DTLS fragments with mismatching or oversized claimed length
    • CVE-2026-33846
  • SECURITY UPDATE: denial of service via non-conforming qsort comparator
    • debian/patches/CVE-2026-42009.patch: return 0 for equal sequence numbers in handshake_compare in lib/gnutls_buffers.c so DTLS packet ordering follows the qsort strict-weak-ordering contract
    • CVE-2026-42009
Record
CLSA-2026-1784018375
Updated
2026-11-02
OSVCLSA-2026-1785847037 No score

gnutls: Fix of 4 CVEs

  • CVE-2026-42009: fix DTLS handshake_compare qsort comparator contract violation (undefined behaviour)
  • CVE-2026-33846: add DTLS reassembly fragment length/bounds checks (heap overwrite)
  • CVE-2026-42012: URI subjectAltName now precludes Common Name fallback in hostname verification
  • CVE-2026-42013: oversized subjectAltName now precludes Common Name fallback in hostname verification
  • CVE-2026-5260: guard PKCS#11 RSA decryption against short-ciphertext heap overread
Record
CLSA-2026-1785847037
Updated
2026-11-02
OSVCLSA-2026-1790280771 No score

gnutls: Fix of 10 CVEs

  • Rebased onto the vendor 3.3.29-9.0.3.el7_9 sources
  • CVE-2026-5260: guard PKCS#11 RSA decryption against short-ciphertext heap overread (TuxCare fix retained)
  • CVE-2026-42014 and CVE-2026-42015 are fixed by the vendor in this build
  • CVE-2026-42011 is not applicable to this baseline per the vendor assessment
  • CVE-2026-33845, CVE-2026-33846, CVE-2026-3833, CVE-2026-42009, CVE-2026-42012 and CVE-2026-42013 are now fixed by the vendor; the TuxCare duplicates are dropped
  • CVE-2026-3833 follow-up: the vendor's email_matches() no longer matches a bare-domain rfc822Name against a bare-domain constraint of the same length, which 3.3.29 did; restore that comparison, case-insensitively, and add the assertions to tests/name-constraints.c
Record
CLSA-2026-1790280771
Updated
2026-11-02
OSVCLSA-2026-1790677972 No score

gnutls: Fix of 10 CVEs

  • Rebased onto the vendor 3.3.29-9.0.3.el7_9 sources
  • CVE-2026-5260: guard PKCS#11 RSA decryption against short-ciphertext heap overread (TuxCare fix retained)
  • CVE-2026-42014 and CVE-2026-42015 are fixed by the vendor in this build
  • CVE-2026-42011 is not applicable to this baseline per the vendor assessment
  • CVE-2026-33845, CVE-2026-33846, CVE-2026-3833, CVE-2026-42009, CVE-2026-42012 and CVE-2026-42013 are now fixed by the vendor; the TuxCare duplicates are dropped
  • CVE-2026-3833 follow-up: the vendor's email_matches() no longer matches a bare-domain rfc822Name against a bare-domain constraint of the same length, which 3.3.29 did; restore that comparison, case-insensitively, and add the assertions to tests/name-constraints.c
Record
CLSA-2026-1790677972
Updated
2026-11-02
OSVCLSA-2026-1790678814 No score

gnutls: Fix of 10 CVEs

  • Rebased onto the vendor 3.3.29-9.0.3.el7_9 sources
  • CVE-2026-5260: guard PKCS#11 RSA decryption against short-ciphertext heap overread (TuxCare fix retained)
  • CVE-2026-42014 and CVE-2026-42015 are fixed by the vendor in this build
  • CVE-2026-42011 is not applicable to this baseline per the vendor assessment
  • CVE-2026-33845, CVE-2026-33846, CVE-2026-3833, CVE-2026-42009, CVE-2026-42012 and CVE-2026-42013 are now fixed by the vendor; the TuxCare duplicates are dropped
  • CVE-2026-3833 follow-up: the vendor's email_matches() no longer matches a bare-domain rfc822Name against a bare-domain constraint of the same length, which 3.3.29 did; restore that comparison, case-insensitively, and add the assertions to tests/name-constraints.c
Record
CLSA-2026-1790678814
Updated
2026-11-02
OSVopenSUSE-SU-2026:10691-1 No score

gnutls-3.8.13-1.1 on GA media

These are all security issues fixed in the gnutls-3.8.13-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10691-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20778-1 No score

Security update for gnutls

This update for gnutls fixes the following issues

  • CVE-2026-3832: cert-session: fix multi-entry OCSP revocation bypass (bsc#1263706).
  • CVE-2026-3833: x509/name-constraints: compare domain names case-insensitive (bsc#1263707).
  • CVE-2026-5260: lib/pkcs11_privkey: guard against overreading on short ciphertexts (bsc#1263715).
  • CVE-2026-5419: gnutls_cipher_decrypt3: make PKCS#7 unpadding branch free (bsc#1263716).
  • CVE-2026-33845: buffers: switch from end_offset over to frag_length (bsc#1263704).
  • CVE-2026-33846: buffers: add more checks to DTLS reassembly (bsc#1263705).
  • CVE-2026-42009: lib/buffers: ensure packets have differing sequence numbers (bsc#1263708).
  • CVE-2026-42010: lib/auth/rsa_psk: fix binary PSK identity lookup (bsc#1263709).
  • CVE-2026-42011: x509/name_constraints: fix intersecting empty constraints (bsc#1263710).
  • CVE-2026-42012: x509/hostname-verify: make URI/SRV SAN preclude CN fallback (bsc#1263711).
  • CVE-2026-42013: x509: prevent fallback on oversized SAN (bsc#1263712).
  • CVE-2026-42014: pkcs11_write: fix UAF and leak in gnutls_pkcs11_token_set_pin (bsc#1263713).
  • CVE-2026-42015: x509/pkcs12_bag: fix off-by-one in bag element bounds chec (bsc#1263714).
Record
openSUSE-SU-2026:20778-1
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-33846 No score

CVE-2026-33846 in rootio-gnutls28 - Patched by Root

Root has patched CVE-2026-33846 in the rootio-gnutls28 package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2026-33846
Updated
2026-11-02
OSVSUSE-SU-2026:2087-1 No score

Security update for gnutls

This update for gnutls fixes the following issues

  • CVE-2026-3833: x509/name-constraints: compare domain names case-insensitive (bsc#1263707).
  • CVE-2026-5260: lib/pkcs11_privkey: guard against overreading on short ciphertexts (bsc#1263715).
  • CVE-2026-33845: buffers: switch from end_offset over to frag_length (bsc#1263704).
  • CVE-2026-33846: buffers: add more checks to DTLS reassembly (bsc#1263705).
  • CVE-2026-42009: lib/buffers: ensure packets have differing sequence numbers (bsc#1263708).
  • CVE-2026-42010: lib/auth/rsa_psk: fix binary PSK identity lookup (bsc#1263709).
  • CVE-2026-42011: x509/name_constraints: fix intersecting empty constraints (bsc#1263710).
  • CVE-2026-42012: x509/hostname-verify: make URI/SRV SAN preclude CN fallback (bsc#1263711).
  • CVE-2026-42013: x509: prevent fallback on oversized SAN (bsc#1263712).
  • CVE-2026-42014: pkcs11_write: fix UAF and leak in gnutls_pkcs11_token_set_pin (bsc#1263713).
  • CVE-2026-42015: x509/pkcs12_bag: fix off-by-one in bag element bounds chec (bsc#1263714).
Record
SUSE-SU-2026:2087-1
Updated
2026-11-02
OSVSUSE-SU-2026:2115-1 No score

Security update for gnutls

This update for gnutls fixes the following issues

  • CVE-2026-3833: x509/name-constraints: compare domain names case-insensitive (bsc#1263707).
  • CVE-2026-5260: lib/pkcs11_privkey: guard against overreading on short ciphertexts (bsc#1263715).
  • CVE-2026-5419: gnutls_cipher_decrypt3: make PKCS#7 unpadding branch free (bsc#1263716).
  • CVE-2026-33845: buffers: switch from end_offset over to frag_length (bsc#1263704).
  • CVE-2026-33846: buffers: add more checks to DTLS reassembly (bsc#1263705).
  • CVE-2026-42009: lib/buffers: ensure packets have differing sequence numbers (bsc#1263708).
  • CVE-2026-42010: lib/auth/rsa_psk: fix binary PSK identity lookup (bsc#1263709).
  • CVE-2026-42011: x509/name_constraints: fix intersecting empty constraints (bsc#1263710).
  • CVE-2026-42012: x509/hostname-verify: make URI/SRV SAN preclude CN fallback (bsc#1263711).
  • CVE-2026-42013: x509: prevent fallback on oversized SAN (bsc#1263712).
  • CVE-2026-42014: pkcs11_write: fix UAF and leak in gnutls_pkcs11_token_set_pin (bsc#1263713).
  • CVE-2026-42015: x509/pkcs12_bag: fix off-by-one in bag element bounds chec (bsc#1263714).
Record
SUSE-SU-2026:2115-1
Updated
2026-11-02
OSVSUSE-SU-2026:21752-1 No score

Security update for gnutls

This update for gnutls fixes the following issues

  • CVE-2026-3832: cert-session: fix multi-entry OCSP revocation bypass (bsc#1263706).
  • CVE-2026-3833: x509/name-constraints: compare domain names case-insensitive (bsc#1263707).
  • CVE-2026-5260: lib/pkcs11_privkey: guard against overreading on short ciphertexts (bsc#1263715).
  • CVE-2026-5419: gnutls_cipher_decrypt3: make PKCS#7 unpadding branch free (bsc#1263716).
  • CVE-2026-33845: buffers: switch from end_offset over to frag_length (bsc#1263704).
  • CVE-2026-33846: buffers: add more checks to DTLS reassembly (bsc#1263705).
  • CVE-2026-42009: lib/buffers: ensure packets have differing sequence numbers (bsc#1263708).
  • CVE-2026-42010: lib/auth/rsa_psk: fix binary PSK identity lookup (bsc#1263709).
  • CVE-2026-42011: x509/name_constraints: fix intersecting empty constraints (bsc#1263710).
  • CVE-2026-42012: x509/hostname-verify: make URI/SRV SAN preclude CN fallback (bsc#1263711).
  • CVE-2026-42013: x509: prevent fallback on oversized SAN (bsc#1263712).
  • CVE-2026-42014: pkcs11_write: fix UAF and leak in gnutls_pkcs11_token_set_pin (bsc#1263713).
  • CVE-2026-42015: x509/pkcs12_bag: fix off-by-one in bag element bounds chec (bsc#1263714).
Record
SUSE-SU-2026:21752-1
Updated
2026-11-02
OSVSUSE-SU-2026:21784-1 No score

Security update for gnutls

This update for gnutls fixes the following issues

  • CVE-2026-3833: x509/name-constraints: compare domain names case-insensitive (bsc#1263707).
  • CVE-2026-5260: lib/pkcs11_privkey: guard against overreading on short ciphertexts (bsc#1263715).
  • CVE-2026-5419: gnutls_cipher_decrypt3: make PKCS#7 unpadding branch free (bsc#1263716).
  • CVE-2026-33845: buffers: switch from end_offset over to frag_length (bsc#1263704).
  • CVE-2026-33846: buffers: add more checks to DTLS reassembly (bsc#1263705).
  • CVE-2026-42009: lib/buffers: ensure packets have differing sequence numbers (bsc#1263708).
  • CVE-2026-42010: lib/auth/rsa_psk: fix binary PSK identity lookup (bsc#1263709).
  • CVE-2026-42011: x509/name_constraints: fix intersecting empty constraints (bsc#1263710).
  • CVE-2026-42012: x509/hostname-verify: make URI/SRV SAN preclude CN fallback (bsc#1263711).
  • CVE-2026-42013: x509: prevent fallback on oversized SAN (bsc#1263712).
  • CVE-2026-42014: pkcs11_write: fix UAF and leak in gnutls_pkcs11_token_set_pin (bsc#1263713).
  • CVE-2026-42015: x509/pkcs12_bag: fix off-by-one in bag element bounds chec (bsc#1263714).
Record
SUSE-SU-2026:21784-1
Updated
2026-11-02
OSVSUSE-SU-2026:21815-1 No score

Security update for gnutls

This update for gnutls fixes the following issues

  • CVE-2026-3832: cert-session: fix multi-entry OCSP revocation bypass (bsc#1263706).
  • CVE-2026-3833: x509/name-constraints: compare domain names case-insensitive (bsc#1263707).
  • CVE-2026-5260: lib/pkcs11_privkey: guard against overreading on short ciphertexts (bsc#1263715).
  • CVE-2026-5419: gnutls_cipher_decrypt3: make PKCS#7 unpadding branch free (bsc#1263716).
  • CVE-2026-33845: buffers: switch from end_offset over to frag_length (bsc#1263704).
  • CVE-2026-33846: buffers: add more checks to DTLS reassembly (bsc#1263705).
  • CVE-2026-42009: lib/buffers: ensure packets have differing sequence numbers (bsc#1263708).
  • CVE-2026-42010: lib/auth/rsa_psk: fix binary PSK identity lookup (bsc#1263709).
  • CVE-2026-42011: x509/name_constraints: fix intersecting empty constraints (bsc#1263710).
  • CVE-2026-42012: x509/hostname-verify: make URI/SRV SAN preclude CN fallback (bsc#1263711).
  • CVE-2026-42013: x509: prevent fallback on oversized SAN (bsc#1263712).
  • CVE-2026-42014: pkcs11_write: fix UAF and leak in gnutls_pkcs11_token_set_pin (bsc#1263713).
  • CVE-2026-42015: x509/pkcs12_bag: fix off-by-one in bag element bounds chec (bsc#1263714).
Record
SUSE-SU-2026:21815-1
Updated
2026-11-02

Affected products

Show 20 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
gnutls
Alpine:v3.20
 before 3.8.13-r0
3.8.13-r0
gnutls
Alpine:v3.21
 before 3.8.13-r0
3.8.13-r0
gnutls
Alpine:v3.22
 before 3.8.13-r0
3.8.13-r0
gnutls
Alpine:v3.23
 before 3.8.13-r0
3.8.13-r0
gnutls
Alpine:v3.24
 before 3.8.13-r0
3.8.13-r0
gnutls
AlmaLinux:8
From an advisory covering 11 CVEs
 before 3.6.16-8.el8_10.6
3.6.16-8.el8_10.6
gnutls-c++
AlmaLinux:8
From an advisory covering 11 CVEs
 before 3.6.16-8.el8_10.6
3.6.16-8.el8_10.6
gnutls-dane
AlmaLinux:8
From an advisory covering 11 CVEs
 before 3.6.16-8.el8_10.6
3.6.16-8.el8_10.6
gnutls-devel
AlmaLinux:8
From an advisory covering 11 CVEs
 before 3.6.16-8.el8_10.6
3.6.16-8.el8_10.6
gnutls-utils
AlmaLinux:8
From an advisory covering 11 CVEs
 before 3.6.16-8.el8_10.6
3.6.16-8.el8_10.6
Show 290 moreShow less
Affected packages
PackageAffectedFixed
gnutls
AlmaLinux:9
From an advisory covering 13 CVEs
 before 3.8.10-4.el9_8
3.8.10-4.el9_8
gnutls-c++
AlmaLinux:9
From an advisory covering 13 CVEs
 before 3.8.10-4.el9_8
3.8.10-4.el9_8
gnutls-dane
AlmaLinux:9
From an advisory covering 13 CVEs
 before 3.8.10-4.el9_8
3.8.10-4.el9_8
gnutls-devel
AlmaLinux:9
From an advisory covering 13 CVEs
 before 3.8.10-4.el9_8
3.8.10-4.el9_8
gnutls-utils
AlmaLinux:9
From an advisory covering 13 CVEs
 before 3.8.10-4.el9_8
3.8.10-4.el9_8
gnutls
AlmaLinux:10
From an advisory covering 13 CVEs
 before 3.8.10-4.el10_2
3.8.10-4.el10_2
gnutls-c++
AlmaLinux:10
From an advisory covering 13 CVEs
 before 3.8.10-4.el10_2
3.8.10-4.el10_2
gnutls-dane
AlmaLinux:10
From an advisory covering 13 CVEs
 before 3.8.10-4.el10_2
3.8.10-4.el10_2
gnutls-devel
AlmaLinux:10
From an advisory covering 13 CVEs
 before 3.8.10-4.el10_2
3.8.10-4.el10_2
gnutls-fips
AlmaLinux:10
From an advisory covering 13 CVEs
 before 3.8.10-4.el10_2
3.8.10-4.el10_2
gnutls-utils
AlmaLinux:10
From an advisory covering 13 CVEs
 before 3.8.10-4.el10_2
3.8.10-4.el10_2
gnutls
Azure Linux:3
 before 3.8.3-11
3.8.3-11
gnutls
Alpaquita:23
 3.7.8-r2 up to 3.8.13-r0
3.8.13-r0
gnutls
Alpaquita:25
 3.8.8-r0 up to 3.8.13-r0
3.8.13-r0
gnutls
Alpaquita:stream
 3.8.0-r3 up to 3.8.13-r0
3.8.13-r0
gnutls
TuxCare:CentOS:8.5
From an advisory covering 8 CVEs
 before 3.6.16-4.el8.tuxcare.els12
3.6.16-4.el8.tuxcare.els12
gnutls-c++
TuxCare:CentOS:8.5
From an advisory covering 8 CVEs
 before 3.6.16-4.el8.tuxcare.els12
3.6.16-4.el8.tuxcare.els12
gnutls-dane
TuxCare:CentOS:8.5
From an advisory covering 8 CVEs
 before 3.6.16-4.el8.tuxcare.els12
3.6.16-4.el8.tuxcare.els12
gnutls-devel
TuxCare:CentOS:8.5
From an advisory covering 8 CVEs
 before 3.6.16-4.el8.tuxcare.els12
3.6.16-4.el8.tuxcare.els12
gnutls-utils
TuxCare:CentOS:8.5
From an advisory covering 8 CVEs
 before 3.6.16-4.el8.tuxcare.els12
3.6.16-4.el8.tuxcare.els12
gnutls
TuxCare:CentOS:8.4
From an advisory covering 8 CVEs
 before 3.6.16-4.el8.tuxcare.els12
3.6.16-4.el8.tuxcare.els12
gnutls-c++
TuxCare:CentOS:8.4
From an advisory covering 8 CVEs
 before 3.6.16-4.el8.tuxcare.els12
3.6.16-4.el8.tuxcare.els12
gnutls-dane
TuxCare:CentOS:8.4
From an advisory covering 8 CVEs
 before 3.6.16-4.el8.tuxcare.els12
3.6.16-4.el8.tuxcare.els12
gnutls-devel
TuxCare:CentOS:8.4
From an advisory covering 8 CVEs
 before 3.6.16-4.el8.tuxcare.els12
3.6.16-4.el8.tuxcare.els12
gnutls-utils
TuxCare:CentOS:8.4
From an advisory covering 8 CVEs
 before 3.6.16-4.el8.tuxcare.els12
3.6.16-4.el8.tuxcare.els12
gnutls
TuxCare:CentOS-Stream:8
From an advisory covering 7 CVEs
 before 3.6.16-8.el8.1.tuxcare.els8
3.6.16-8.el8.1.tuxcare.els8
gnutls-c++
TuxCare:CentOS-Stream:8
From an advisory covering 7 CVEs
 before 3.6.16-8.el8.1.tuxcare.els8
3.6.16-8.el8.1.tuxcare.els8
gnutls-dane
TuxCare:CentOS-Stream:8
From an advisory covering 7 CVEs
 before 3.6.16-8.el8.1.tuxcare.els8
3.6.16-8.el8.1.tuxcare.els8
gnutls-devel
TuxCare:CentOS-Stream:8
From an advisory covering 7 CVEs
 before 3.6.16-8.el8.1.tuxcare.els8
3.6.16-8.el8.1.tuxcare.els8
gnutls-utils
TuxCare:CentOS-Stream:8
From an advisory covering 7 CVEs
 before 3.6.16-8.el8.1.tuxcare.els8
3.6.16-8.el8.1.tuxcare.els8
gnutls
TuxCare:AlmaLinux:9.6
From an advisory covering 8 CVEs
 before 3.8.3-9.el9_6.tuxcare.1.els6
3.8.3-9.el9_6.tuxcare.1.els6
gnutls-c++
TuxCare:AlmaLinux:9.6
From an advisory covering 8 CVEs
 before 3.8.3-9.el9_6.tuxcare.1.els6
3.8.3-9.el9_6.tuxcare.1.els6
gnutls-dane
TuxCare:AlmaLinux:9.6
From an advisory covering 8 CVEs
 before 3.8.3-9.el9_6.tuxcare.1.els6
3.8.3-9.el9_6.tuxcare.1.els6
gnutls-devel
TuxCare:AlmaLinux:9.6
From an advisory covering 8 CVEs
 before 3.8.3-9.el9_6.tuxcare.1.els6
3.8.3-9.el9_6.tuxcare.1.els6
gnutls-utils
TuxCare:AlmaLinux:9.6
From an advisory covering 8 CVEs
 before 3.8.3-9.el9_6.tuxcare.1.els6
3.8.3-9.el9_6.tuxcare.1.els6
gnutls
TuxCare:CentOS:7
From an advisory covering 5 CVEs
 before 3.3.29-9.el7_9.tuxcare.els5
3.3.29-9.el7_9.tuxcare.els5
gnutls-c++
TuxCare:CentOS:7
From an advisory covering 5 CVEs
 before 3.3.29-9.el7_9.tuxcare.els5
3.3.29-9.el7_9.tuxcare.els5
gnutls-dane
TuxCare:CentOS:7
From an advisory covering 5 CVEs
 before 3.3.29-9.el7_9.tuxcare.els5
3.3.29-9.el7_9.tuxcare.els5
gnutls-devel
TuxCare:CentOS:7
From an advisory covering 5 CVEs
 before 3.3.29-9.el7_9.tuxcare.els5
3.3.29-9.el7_9.tuxcare.els5
gnutls-utils
TuxCare:CentOS:7
From an advisory covering 5 CVEs
 before 3.3.29-9.el7_9.tuxcare.els5
3.3.29-9.el7_9.tuxcare.els5
gnutls
TuxCare:RHEL:7
From an advisory covering 5 CVEs
 before 3.3.29-9.el7_6.tuxcare.els5
3.3.29-9.el7_6.tuxcare.els5
gnutls-c++
TuxCare:RHEL:7
From an advisory covering 5 CVEs
 before 3.3.29-9.el7_6.tuxcare.els5
3.3.29-9.el7_6.tuxcare.els5
gnutls-dane
TuxCare:RHEL:7
From an advisory covering 5 CVEs
 before 3.3.29-9.el7_6.tuxcare.els5
3.3.29-9.el7_6.tuxcare.els5
gnutls-devel
TuxCare:RHEL:7
From an advisory covering 5 CVEs
 before 3.3.29-9.el7_6.tuxcare.els5
3.3.29-9.el7_6.tuxcare.els5
gnutls-utils
TuxCare:RHEL:7
From an advisory covering 5 CVEs
 before 3.3.29-9.el7_6.tuxcare.els5
3.3.29-9.el7_6.tuxcare.els5
gnutls-bin
TuxCare:Ubuntu:20.04
From an advisory covering 3 CVEs
 before 3.6.13-2ubuntu1.12+tuxcare.els5
3.6.13-2ubuntu1.12+tuxcare.els5
gnutls-doc
TuxCare:Ubuntu:20.04
From an advisory covering 3 CVEs
 before 3.6.13-2ubuntu1.12+tuxcare.els5
3.6.13-2ubuntu1.12+tuxcare.els5
guile-gnutls
TuxCare:Ubuntu:20.04
From an advisory covering 3 CVEs
 before 3.6.13-2ubuntu1.12+tuxcare.els5
3.6.13-2ubuntu1.12+tuxcare.els5
libgnutls-dane0
TuxCare:Ubuntu:20.04
From an advisory covering 3 CVEs
 before 3.6.13-2ubuntu1.12+tuxcare.els5
3.6.13-2ubuntu1.12+tuxcare.els5
libgnutls-openssl27
TuxCare:Ubuntu:20.04
From an advisory covering 3 CVEs
 before 3.6.13-2ubuntu1.12+tuxcare.els5
3.6.13-2ubuntu1.12+tuxcare.els5
libgnutls28-dev
TuxCare:Ubuntu:20.04
From an advisory covering 3 CVEs
 before 3.6.13-2ubuntu1.12+tuxcare.els5
3.6.13-2ubuntu1.12+tuxcare.els5
libgnutls30
TuxCare:Ubuntu:20.04
From an advisory covering 3 CVEs
 before 3.6.13-2ubuntu1.12+tuxcare.els5
3.6.13-2ubuntu1.12+tuxcare.els5
libgnutlsxx28
TuxCare:Ubuntu:20.04
From an advisory covering 3 CVEs
 before 3.6.13-2ubuntu1.12+tuxcare.els5
3.6.13-2ubuntu1.12+tuxcare.els5
gnutls-bin
TuxCare:Ubuntu:18.04
From an advisory covering 3 CVEs
 before 3.5.18-1ubuntu1.6+tuxcare.els4
3.5.18-1ubuntu1.6+tuxcare.els4
gnutls-doc
TuxCare:Ubuntu:18.04
From an advisory covering 3 CVEs
 before 3.5.18-1ubuntu1.6+tuxcare.els4
3.5.18-1ubuntu1.6+tuxcare.els4
libgnutls-dane0
TuxCare:Ubuntu:18.04
From an advisory covering 3 CVEs
 before 3.5.18-1ubuntu1.6+tuxcare.els4
3.5.18-1ubuntu1.6+tuxcare.els4
libgnutls-openssl27
TuxCare:Ubuntu:18.04
From an advisory covering 3 CVEs
 before 3.5.18-1ubuntu1.6+tuxcare.els4
3.5.18-1ubuntu1.6+tuxcare.els4
libgnutls28-dev
TuxCare:Ubuntu:18.04
From an advisory covering 3 CVEs
 before 3.5.18-1ubuntu1.6+tuxcare.els4
3.5.18-1ubuntu1.6+tuxcare.els4
libgnutls30
TuxCare:Ubuntu:18.04
From an advisory covering 3 CVEs
 before 3.5.18-1ubuntu1.6+tuxcare.els4
3.5.18-1ubuntu1.6+tuxcare.els4
libgnutlsxx28
TuxCare:Ubuntu:18.04
From an advisory covering 3 CVEs
 before 3.5.18-1ubuntu1.6+tuxcare.els4
3.5.18-1ubuntu1.6+tuxcare.els4
gnutls-bin
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 3.4.10-4ubuntu1.9+tuxcare.els3
3.4.10-4ubuntu1.9+tuxcare.els3
gnutls-doc
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 3.4.10-4ubuntu1.9+tuxcare.els3
3.4.10-4ubuntu1.9+tuxcare.els3
guile-gnutls
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 3.4.10-4ubuntu1.9+tuxcare.els3
3.4.10-4ubuntu1.9+tuxcare.els3
libgnutls-dev
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 3.4.10-4ubuntu1.9+tuxcare.els3
3.4.10-4ubuntu1.9+tuxcare.els3
libgnutls-openssl27
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 3.4.10-4ubuntu1.9+tuxcare.els3
3.4.10-4ubuntu1.9+tuxcare.els3
libgnutls28-dev
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 3.4.10-4ubuntu1.9+tuxcare.els3
3.4.10-4ubuntu1.9+tuxcare.els3
libgnutls30
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 3.4.10-4ubuntu1.9+tuxcare.els3
3.4.10-4ubuntu1.9+tuxcare.els3
libgnutlsxx28
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 3.4.10-4ubuntu1.9+tuxcare.els3
3.4.10-4ubuntu1.9+tuxcare.els3
gnutls
TuxCare:OracleLinux:7
From an advisory covering 5 CVEs
 before 3.3.29-9.el7_6.tuxcare.els5
3.3.29-9.el7_6.tuxcare.els5
gnutls-c++
TuxCare:OracleLinux:7
From an advisory covering 5 CVEs
 before 3.3.29-9.el7_6.tuxcare.els5
3.3.29-9.el7_6.tuxcare.els5
gnutls-dane
TuxCare:OracleLinux:7
From an advisory covering 5 CVEs
 before 3.3.29-9.el7_6.tuxcare.els5
3.3.29-9.el7_6.tuxcare.els5
gnutls-devel
TuxCare:OracleLinux:7
From an advisory covering 5 CVEs
 before 3.3.29-9.el7_6.tuxcare.els5
3.3.29-9.el7_6.tuxcare.els5
gnutls-utils
TuxCare:OracleLinux:7
From an advisory covering 5 CVEs
 before 3.3.29-9.el7_6.tuxcare.els5
3.3.29-9.el7_6.tuxcare.els5
gnutls
TuxCare:OracleLinux:7
From an advisory covering 10 CVEs
 before 3.3.29-9.0.3.el7_9.tuxcare.els1
3.3.29-9.0.3.el7_9.tuxcare.els1
gnutls-c++
TuxCare:OracleLinux:7
From an advisory covering 10 CVEs
 before 3.3.29-9.0.3.el7_9.tuxcare.els1
3.3.29-9.0.3.el7_9.tuxcare.els1
gnutls-dane
TuxCare:OracleLinux:7
From an advisory covering 10 CVEs
 before 3.3.29-9.0.3.el7_9.tuxcare.els1
3.3.29-9.0.3.el7_9.tuxcare.els1
gnutls-devel
TuxCare:OracleLinux:7
From an advisory covering 10 CVEs
 before 3.3.29-9.0.3.el7_9.tuxcare.els1
3.3.29-9.0.3.el7_9.tuxcare.els1
gnutls-utils
TuxCare:OracleLinux:7
From an advisory covering 10 CVEs
 before 3.3.29-9.0.3.el7_9.tuxcare.els1
3.3.29-9.0.3.el7_9.tuxcare.els1
gnutls
TuxCare:CentOS:7
From an advisory covering 10 CVEs
 before 3.3.29-9.0.3.el7_9.tuxcare.els1
3.3.29-9.0.3.el7_9.tuxcare.els1
gnutls-c++
TuxCare:CentOS:7
From an advisory covering 10 CVEs
 before 3.3.29-9.0.3.el7_9.tuxcare.els1
3.3.29-9.0.3.el7_9.tuxcare.els1
gnutls-dane
TuxCare:CentOS:7
From an advisory covering 10 CVEs
 before 3.3.29-9.0.3.el7_9.tuxcare.els1
3.3.29-9.0.3.el7_9.tuxcare.els1
gnutls-devel
TuxCare:CentOS:7
From an advisory covering 10 CVEs
 before 3.3.29-9.0.3.el7_9.tuxcare.els1
3.3.29-9.0.3.el7_9.tuxcare.els1
gnutls-utils
TuxCare:CentOS:7
From an advisory covering 10 CVEs
 before 3.3.29-9.0.3.el7_9.tuxcare.els1
3.3.29-9.0.3.el7_9.tuxcare.els1
gnutls
TuxCare:RHEL:7
From an advisory covering 10 CVEs
 before 3.3.29-9.0.3.el7_6.tuxcare.els1
3.3.29-9.0.3.el7_6.tuxcare.els1
gnutls-c++
TuxCare:RHEL:7
From an advisory covering 10 CVEs
 before 3.3.29-9.0.3.el7_6.tuxcare.els1
3.3.29-9.0.3.el7_6.tuxcare.els1
gnutls-dane
TuxCare:RHEL:7
From an advisory covering 10 CVEs
 before 3.3.29-9.0.3.el7_6.tuxcare.els1
3.3.29-9.0.3.el7_6.tuxcare.els1
gnutls-devel
TuxCare:RHEL:7
From an advisory covering 10 CVEs
 before 3.3.29-9.0.3.el7_6.tuxcare.els1
3.3.29-9.0.3.el7_6.tuxcare.els1
gnutls-utils
TuxCare:RHEL:7
From an advisory covering 10 CVEs
 before 3.3.29-9.0.3.el7_6.tuxcare.els1
3.3.29-9.0.3.el7_6.tuxcare.els1
gnutls28
Debian:12
 before 3.7.9-2+deb12u7, plus listed versions
3.7.9-23.7.9-2+deb12u13.7.9-2+deb12u23.7.9-2+deb12u33.7.9-2+deb12u43.7.9-2+deb12u53.7.9-2+deb12u6
3.7.9-2+deb12u7
gnutls28
Debian:13
 before 3.8.9-3+deb13u4, plus listed versions
3.8.9-33.8.9-3+deb13u13.8.9-3+deb13u23.8.9-3+deb13u3
3.8.9-3+deb13u4
gnutls28
Debian:14
 before 3.8.13-1, plus listed versions
3.8.10-13.8.10-23.8.10-33.8.11-13.8.11-2
Show 6 moreShow less
3.8.11-33.8.12-13.8.12-23.8.12-33.8.12-43.8.9-3
3.8.13-1
gnutls
openEuler:20.03-LTS-SP4
 before 3.6.14-21.oe2003sp4
3.6.14-21.oe2003sp4
gnutls
openEuler:22.03-LTS-SP4
 before 3.7.2-22.oe2203sp4
3.7.2-22.oe2203sp4
gnutls
openEuler:24.03-LTS
From an advisory covering 9 CVEs
 before 3.8.2-14.oe2403
3.8.2-14.oe2403
gnutls
openEuler:24.03-LTS-SP1
From an advisory covering 9 CVEs
 before 3.8.2-14.oe2403sp1
3.8.2-14.oe2403sp1
gnutls
openEuler:24.03-LTS-SP3
From an advisory covering 9 CVEs
 before 3.8.2-14.oe2403sp3
3.8.2-14.oe2403sp3
gnutls
Red Hat:hummingbird:1
From an advisory covering 13 CVEs
 before 0:3.8.13-1.hum1
0:3.8.13-1.hum1
gnutls-c++
Red Hat:hummingbird:1
From an advisory covering 13 CVEs
 before 0:3.8.13-1.hum1
0:3.8.13-1.hum1
gnutls-dane
Red Hat:hummingbird:1
From an advisory covering 13 CVEs
 before 0:3.8.13-1.hum1
0:3.8.13-1.hum1
gnutls-devel
Red Hat:hummingbird:1
From an advisory covering 13 CVEs
 before 0:3.8.13-1.hum1
0:3.8.13-1.hum1
gnutls-fips
Red Hat:hummingbird:1
From an advisory covering 13 CVEs
 before 0:3.8.13-1.hum1
0:3.8.13-1.hum1
gnutls-utils
Red Hat:hummingbird:1
From an advisory covering 13 CVEs
 before 0:3.8.13-1.hum1
0:3.8.13-1.hum1
mingw32-gnutls
Red Hat:hummingbird:1
From an advisory covering 13 CVEs
 before 0:3.8.13-1.hum1
0:3.8.13-1.hum1
mingw64-gnutls
Red Hat:hummingbird:1
From an advisory covering 13 CVEs
 before 0:3.8.13-1.hum1
0:3.8.13-1.hum1
gnutls-c++
Red Hat:enterprise_linux:8::appstream
From an advisory covering 11 CVEs
 before 0:3.6.16-8.el8_10.6
0:3.6.16-8.el8_10.6
gnutls-c++-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 11 CVEs
 before 0:3.6.16-8.el8_10.6
0:3.6.16-8.el8_10.6
gnutls-dane
Red Hat:enterprise_linux:8::appstream
From an advisory covering 11 CVEs
 before 0:3.6.16-8.el8_10.6
0:3.6.16-8.el8_10.6
gnutls-dane-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 11 CVEs
 before 0:3.6.16-8.el8_10.6
0:3.6.16-8.el8_10.6
gnutls-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 11 CVEs
 before 0:3.6.16-8.el8_10.6
0:3.6.16-8.el8_10.6
gnutls-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 11 CVEs
 before 0:3.6.16-8.el8_10.6
0:3.6.16-8.el8_10.6
gnutls-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 11 CVEs
 before 0:3.6.16-8.el8_10.6
0:3.6.16-8.el8_10.6
gnutls-utils
Red Hat:enterprise_linux:8::appstream
From an advisory covering 11 CVEs
 before 0:3.6.16-8.el8_10.6
0:3.6.16-8.el8_10.6
gnutls-utils-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 11 CVEs
 before 0:3.6.16-8.el8_10.6
0:3.6.16-8.el8_10.6
gnutls
Red Hat:enterprise_linux:8::baseos
From an advisory covering 11 CVEs
 before 0:3.6.16-8.el8_10.6
0:3.6.16-8.el8_10.6
gnutls-c++-debuginfo
Red Hat:enterprise_linux:8::baseos
From an advisory covering 11 CVEs
 before 0:3.6.16-8.el8_10.6
0:3.6.16-8.el8_10.6
gnutls-dane-debuginfo
Red Hat:enterprise_linux:8::baseos
From an advisory covering 11 CVEs
 before 0:3.6.16-8.el8_10.6
0:3.6.16-8.el8_10.6
gnutls-debuginfo
Red Hat:enterprise_linux:8::baseos
From an advisory covering 11 CVEs
 before 0:3.6.16-8.el8_10.6
0:3.6.16-8.el8_10.6
gnutls-debugsource
Red Hat:enterprise_linux:8::baseos
From an advisory covering 11 CVEs
 before 0:3.6.16-8.el8_10.6
0:3.6.16-8.el8_10.6
gnutls-utils-debuginfo
Red Hat:enterprise_linux:8::baseos
From an advisory covering 11 CVEs
 before 0:3.6.16-8.el8_10.6
0:3.6.16-8.el8_10.6
gnutls-c++
Red Hat:enterprise_linux:9::appstream
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el9_8
0:3.8.10-4.el9_8
gnutls-c++-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el9_8
0:3.8.10-4.el9_8
gnutls-dane
Red Hat:enterprise_linux:9::appstream
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el9_8
0:3.8.10-4.el9_8
gnutls-dane-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el9_8
0:3.8.10-4.el9_8
gnutls-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el9_8
0:3.8.10-4.el9_8
gnutls-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el9_8
0:3.8.10-4.el9_8
gnutls-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el9_8
0:3.8.10-4.el9_8
gnutls-utils
Red Hat:enterprise_linux:9::appstream
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el9_8
0:3.8.10-4.el9_8
gnutls-utils-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el9_8
0:3.8.10-4.el9_8
gnutls
Red Hat:enterprise_linux:9::baseos
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el9_8
0:3.8.10-4.el9_8
gnutls-c++-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el9_8
0:3.8.10-4.el9_8
gnutls-dane-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el9_8
0:3.8.10-4.el9_8
gnutls-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el9_8
0:3.8.10-4.el9_8
gnutls-debugsource
Red Hat:enterprise_linux:9::baseos
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el9_8
0:3.8.10-4.el9_8
gnutls-utils-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el9_8
0:3.8.10-4.el9_8
gnutls-c++
Red Hat:enterprise_linux:10.2
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el10_2
0:3.8.10-4.el10_2
gnutls-c++-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el10_2
0:3.8.10-4.el10_2
gnutls-dane
Red Hat:enterprise_linux:10.2
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el10_2
0:3.8.10-4.el10_2
gnutls-dane-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el10_2
0:3.8.10-4.el10_2
gnutls-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el10_2
0:3.8.10-4.el10_2
gnutls-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el10_2
0:3.8.10-4.el10_2
gnutls-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el10_2
0:3.8.10-4.el10_2
gnutls-fips
Red Hat:enterprise_linux:10.2
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el10_2
0:3.8.10-4.el10_2
gnutls-utils
Red Hat:enterprise_linux:10.2
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el10_2
0:3.8.10-4.el10_2
gnutls-utils-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el10_2
0:3.8.10-4.el10_2
gnutls
Red Hat:enterprise_linux:10.2
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el10_2
0:3.8.10-4.el10_2
gnutls-c++
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 0:3.8.9-9.el10_0.19
0:3.8.9-9.el10_0.19
gnutls-dane
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 0:3.8.9-9.el10_0.19
0:3.8.9-9.el10_0.19
gnutls-dane-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 0:3.8.9-9.el10_0.19
0:3.8.9-9.el10_0.19
gnutls-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 0:3.8.9-9.el10_0.19
0:3.8.9-9.el10_0.19
gnutls-debugsource
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 0:3.8.9-9.el10_0.19
0:3.8.9-9.el10_0.19
gnutls-devel
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 0:3.8.9-9.el10_0.19
0:3.8.9-9.el10_0.19
gnutls-fips
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 0:3.8.9-9.el10_0.19
0:3.8.9-9.el10_0.19
gnutls-utils
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 0:3.8.9-9.el10_0.19
0:3.8.9-9.el10_0.19
gnutls-utils-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 0:3.8.9-9.el10_0.19
0:3.8.9-9.el10_0.19
gnutls
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 0:3.8.9-9.el10_0.19
0:3.8.9-9.el10_0.19
gnutls-c++-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 13 CVEs
 before 0:3.8.9-9.el10_0.19
0:3.8.9-9.el10_0.19
gnutls-c++
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 12 CVEs
 before 0:3.8.3-6.el9_6.4
0:3.8.3-6.el9_6.4
gnutls-dane
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 12 CVEs
 before 0:3.8.3-6.el9_6.4
0:3.8.3-6.el9_6.4
gnutls-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 12 CVEs
 before 0:3.8.3-6.el9_6.4
0:3.8.3-6.el9_6.4
gnutls-debugsource
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 12 CVEs
 before 0:3.8.3-6.el9_6.4
0:3.8.3-6.el9_6.4
gnutls-devel
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 12 CVEs
 before 0:3.8.3-6.el9_6.4
0:3.8.3-6.el9_6.4
gnutls-utils
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 12 CVEs
 before 0:3.8.3-6.el9_6.4
0:3.8.3-6.el9_6.4
gnutls-utils-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 12 CVEs
 before 0:3.8.3-6.el9_6.4
0:3.8.3-6.el9_6.4
gnutls
Red Hat:rhel_eus:9.6::baseos
From an advisory covering 12 CVEs
 before 0:3.8.3-6.el9_6.4
0:3.8.3-6.el9_6.4
gnutls-debuginfo
Red Hat:rhel_eus:9.6::baseos
From an advisory covering 12 CVEs
 before 0:3.8.3-6.el9_6.4
0:3.8.3-6.el9_6.4
gnutls-debugsource
Red Hat:rhel_eus:9.6::baseos
From an advisory covering 12 CVEs
 before 0:3.8.3-6.el9_6.4
0:3.8.3-6.el9_6.4
gnutls-utils-debuginfo
Red Hat:rhel_eus:9.6::baseos
From an advisory covering 12 CVEs
 before 0:3.8.3-6.el9_6.4
0:3.8.3-6.el9_6.4
gnutls-c++
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-5.el8_6.5
0:3.6.16-5.el8_6.5
gnutls-dane
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-5.el8_6.5
0:3.6.16-5.el8_6.5
gnutls-dane-debuginfo
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-5.el8_6.5
0:3.6.16-5.el8_6.5
gnutls-debuginfo
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-5.el8_6.5
0:3.6.16-5.el8_6.5
gnutls-debugsource
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-5.el8_6.5
0:3.6.16-5.el8_6.5
gnutls-devel
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-5.el8_6.5
0:3.6.16-5.el8_6.5
gnutls-utils
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-5.el8_6.5
0:3.6.16-5.el8_6.5
gnutls-utils-debuginfo
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-5.el8_6.5
0:3.6.16-5.el8_6.5
libtasn1-debuginfo
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 13 CVEs
 before 0:4.13-3.el8_6.2
0:4.13-3.el8_6.2
libtasn1-debugsource
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 13 CVEs
 before 0:4.13-3.el8_6.2
0:4.13-3.el8_6.2
libtasn1-devel
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 13 CVEs
 before 0:4.13-3.el8_6.2
0:4.13-3.el8_6.2
libtasn1-tools
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 13 CVEs
 before 0:4.13-3.el8_6.2
0:4.13-3.el8_6.2
libtasn1-tools-debuginfo
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 13 CVEs
 before 0:4.13-3.el8_6.2
0:4.13-3.el8_6.2
gnutls-c++
Red Hat:rhel_eus_long_life:8.6::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-5.el8_6.5
0:3.6.16-5.el8_6.5
gnutls-dane
Red Hat:rhel_eus_long_life:8.6::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-5.el8_6.5
0:3.6.16-5.el8_6.5
gnutls-dane-debuginfo
Red Hat:rhel_eus_long_life:8.6::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-5.el8_6.5
0:3.6.16-5.el8_6.5
gnutls-debuginfo
Red Hat:rhel_eus_long_life:8.6::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-5.el8_6.5
0:3.6.16-5.el8_6.5
gnutls-debugsource
Red Hat:rhel_eus_long_life:8.6::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-5.el8_6.5
0:3.6.16-5.el8_6.5
gnutls-devel
Red Hat:rhel_eus_long_life:8.6::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-5.el8_6.5
0:3.6.16-5.el8_6.5
gnutls-utils
Red Hat:rhel_eus_long_life:8.6::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-5.el8_6.5
0:3.6.16-5.el8_6.5
gnutls-utils-debuginfo
Red Hat:rhel_eus_long_life:8.6::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-5.el8_6.5
0:3.6.16-5.el8_6.5
libtasn1-debuginfo
Red Hat:rhel_eus_long_life:8.6::appstream
From an advisory covering 13 CVEs
 before 0:4.13-3.el8_6.2
0:4.13-3.el8_6.2
libtasn1-debugsource
Red Hat:rhel_eus_long_life:8.6::appstream
From an advisory covering 13 CVEs
 before 0:4.13-3.el8_6.2
0:4.13-3.el8_6.2
libtasn1-devel
Red Hat:rhel_eus_long_life:8.6::appstream
From an advisory covering 13 CVEs
 before 0:4.13-3.el8_6.2
0:4.13-3.el8_6.2
libtasn1-tools
Red Hat:rhel_eus_long_life:8.6::appstream
From an advisory covering 13 CVEs
 before 0:4.13-3.el8_6.2
0:4.13-3.el8_6.2
libtasn1-tools-debuginfo
Red Hat:rhel_eus_long_life:8.6::appstream
From an advisory covering 13 CVEs
 before 0:4.13-3.el8_6.2
0:4.13-3.el8_6.2
gnutls
Red Hat:rhel_aus:8.6::baseos
From an advisory covering 13 CVEs
 before 0:3.6.16-5.el8_6.5
0:3.6.16-5.el8_6.5
gnutls-dane-debuginfo
Red Hat:rhel_aus:8.6::baseos
From an advisory covering 13 CVEs
 before 0:3.6.16-5.el8_6.5
0:3.6.16-5.el8_6.5
gnutls-debuginfo
Red Hat:rhel_aus:8.6::baseos
From an advisory covering 13 CVEs
 before 0:3.6.16-5.el8_6.5
0:3.6.16-5.el8_6.5
gnutls-debugsource
Red Hat:rhel_aus:8.6::baseos
From an advisory covering 13 CVEs
 before 0:3.6.16-5.el8_6.5
0:3.6.16-5.el8_6.5
gnutls-utils-debuginfo
Red Hat:rhel_aus:8.6::baseos
From an advisory covering 13 CVEs
 before 0:3.6.16-5.el8_6.5
0:3.6.16-5.el8_6.5
libtasn1
Red Hat:rhel_aus:8.6::baseos
From an advisory covering 13 CVEs
 before 0:4.13-3.el8_6.2
0:4.13-3.el8_6.2
libtasn1-debuginfo
Red Hat:rhel_aus:8.6::baseos
From an advisory covering 13 CVEs
 before 0:4.13-3.el8_6.2
0:4.13-3.el8_6.2
libtasn1-debugsource
Red Hat:rhel_aus:8.6::baseos
From an advisory covering 13 CVEs
 before 0:4.13-3.el8_6.2
0:4.13-3.el8_6.2
libtasn1-tools-debuginfo
Red Hat:rhel_aus:8.6::baseos
From an advisory covering 13 CVEs
 before 0:4.13-3.el8_6.2
0:4.13-3.el8_6.2
gnutls
Red Hat:rhel_eus_long_life:8.6::baseos
From an advisory covering 13 CVEs
 before 0:3.6.16-5.el8_6.5
0:3.6.16-5.el8_6.5
gnutls-dane-debuginfo
Red Hat:rhel_eus_long_life:8.6::baseos
From an advisory covering 13 CVEs
 before 0:3.6.16-5.el8_6.5
0:3.6.16-5.el8_6.5
gnutls-debuginfo
Red Hat:rhel_eus_long_life:8.6::baseos
From an advisory covering 13 CVEs
 before 0:3.6.16-5.el8_6.5
0:3.6.16-5.el8_6.5
gnutls-debugsource
Red Hat:rhel_eus_long_life:8.6::baseos
From an advisory covering 13 CVEs
 before 0:3.6.16-5.el8_6.5
0:3.6.16-5.el8_6.5
gnutls-utils-debuginfo
Red Hat:rhel_eus_long_life:8.6::baseos
From an advisory covering 13 CVEs
 before 0:3.6.16-5.el8_6.5
0:3.6.16-5.el8_6.5
libtasn1
Red Hat:rhel_eus_long_life:8.6::baseos
From an advisory covering 13 CVEs
 before 0:4.13-3.el8_6.2
0:4.13-3.el8_6.2
libtasn1-debuginfo
Red Hat:rhel_eus_long_life:8.6::baseos
From an advisory covering 13 CVEs
 before 0:4.13-3.el8_6.2
0:4.13-3.el8_6.2
libtasn1-debugsource
Red Hat:rhel_eus_long_life:8.6::baseos
From an advisory covering 13 CVEs
 before 0:4.13-3.el8_6.2
0:4.13-3.el8_6.2
libtasn1-tools-debuginfo
Red Hat:rhel_eus_long_life:8.6::baseos
From an advisory covering 13 CVEs
 before 0:4.13-3.el8_6.2
0:4.13-3.el8_6.2
gnutls-c++-debuginfo
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-5.el8_6.5
0:3.6.16-5.el8_6.5
gnutls-c++-debuginfo
Red Hat:rhel_eus_long_life:8.6::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-5.el8_6.5
0:3.6.16-5.el8_6.5
gnutls-c++-debuginfo
Red Hat:rhel_aus:8.6::baseos
From an advisory covering 13 CVEs
 before 0:3.6.16-5.el8_6.5
0:3.6.16-5.el8_6.5
gnutls-c++-debuginfo
Red Hat:rhel_eus_long_life:8.6::baseos
From an advisory covering 13 CVEs
 before 0:3.6.16-5.el8_6.5
0:3.6.16-5.el8_6.5
gnutls-c++
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-7.el8_8.4
0:3.6.16-7.el8_8.4
gnutls-dane
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-7.el8_8.4
0:3.6.16-7.el8_8.4
gnutls-dane-debuginfo
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-7.el8_8.4
0:3.6.16-7.el8_8.4
gnutls-debuginfo
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-7.el8_8.4
0:3.6.16-7.el8_8.4
gnutls-debugsource
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-7.el8_8.4
0:3.6.16-7.el8_8.4
gnutls-devel
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-7.el8_8.4
0:3.6.16-7.el8_8.4
gnutls-utils
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-7.el8_8.4
0:3.6.16-7.el8_8.4
gnutls-utils-debuginfo
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-7.el8_8.4
0:3.6.16-7.el8_8.4
libtasn1-debuginfo
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 13 CVEs
 before 0:4.13-4.el8_8.1
0:4.13-4.el8_8.1
libtasn1-debugsource
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 13 CVEs
 before 0:4.13-4.el8_8.1
0:4.13-4.el8_8.1
libtasn1-devel
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 13 CVEs
 before 0:4.13-4.el8_8.1
0:4.13-4.el8_8.1
libtasn1-tools
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 13 CVEs
 before 0:4.13-4.el8_8.1
0:4.13-4.el8_8.1
libtasn1-tools-debuginfo
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 13 CVEs
 before 0:4.13-4.el8_8.1
0:4.13-4.el8_8.1
gnutls-c++
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-7.el8_8.4
0:3.6.16-7.el8_8.4
gnutls-dane
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-7.el8_8.4
0:3.6.16-7.el8_8.4
gnutls-dane-debuginfo
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-7.el8_8.4
0:3.6.16-7.el8_8.4
gnutls-debuginfo
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-7.el8_8.4
0:3.6.16-7.el8_8.4
gnutls-debugsource
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-7.el8_8.4
0:3.6.16-7.el8_8.4
gnutls-devel
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-7.el8_8.4
0:3.6.16-7.el8_8.4
gnutls-utils
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-7.el8_8.4
0:3.6.16-7.el8_8.4
gnutls-utils-debuginfo
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-7.el8_8.4
0:3.6.16-7.el8_8.4
libtasn1-debuginfo
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 13 CVEs
 before 0:4.13-4.el8_8.1
0:4.13-4.el8_8.1
libtasn1-debugsource
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 13 CVEs
 before 0:4.13-4.el8_8.1
0:4.13-4.el8_8.1
libtasn1-devel
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 13 CVEs
 before 0:4.13-4.el8_8.1
0:4.13-4.el8_8.1
libtasn1-tools
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 13 CVEs
 before 0:4.13-4.el8_8.1
0:4.13-4.el8_8.1
libtasn1-tools-debuginfo
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 13 CVEs
 before 0:4.13-4.el8_8.1
0:4.13-4.el8_8.1
gnutls
Red Hat:rhel_e4s:8.8::baseos
From an advisory covering 13 CVEs
 before 0:3.6.16-7.el8_8.4
0:3.6.16-7.el8_8.4
gnutls-dane-debuginfo
Red Hat:rhel_e4s:8.8::baseos
From an advisory covering 13 CVEs
 before 0:3.6.16-7.el8_8.4
0:3.6.16-7.el8_8.4
gnutls-debuginfo
Red Hat:rhel_e4s:8.8::baseos
From an advisory covering 13 CVEs
 before 0:3.6.16-7.el8_8.4
0:3.6.16-7.el8_8.4
gnutls-debugsource
Red Hat:rhel_e4s:8.8::baseos
From an advisory covering 13 CVEs
 before 0:3.6.16-7.el8_8.4
0:3.6.16-7.el8_8.4
gnutls-utils-debuginfo
Red Hat:rhel_e4s:8.8::baseos
From an advisory covering 13 CVEs
 before 0:3.6.16-7.el8_8.4
0:3.6.16-7.el8_8.4
libtasn1
Red Hat:rhel_e4s:8.8::baseos
From an advisory covering 13 CVEs
 before 0:4.13-4.el8_8.1
0:4.13-4.el8_8.1
libtasn1-debuginfo
Red Hat:rhel_e4s:8.8::baseos
From an advisory covering 13 CVEs
 before 0:4.13-4.el8_8.1
0:4.13-4.el8_8.1
libtasn1-debugsource
Red Hat:rhel_e4s:8.8::baseos
From an advisory covering 13 CVEs
 before 0:4.13-4.el8_8.1
0:4.13-4.el8_8.1
libtasn1-tools-debuginfo
Red Hat:rhel_e4s:8.8::baseos
From an advisory covering 13 CVEs
 before 0:4.13-4.el8_8.1
0:4.13-4.el8_8.1
gnutls
Red Hat:rhel_tus:8.8::baseos
From an advisory covering 13 CVEs
 before 0:3.6.16-7.el8_8.4
0:3.6.16-7.el8_8.4
gnutls-dane-debuginfo
Red Hat:rhel_tus:8.8::baseos
From an advisory covering 13 CVEs
 before 0:3.6.16-7.el8_8.4
0:3.6.16-7.el8_8.4
gnutls-debuginfo
Red Hat:rhel_tus:8.8::baseos
From an advisory covering 13 CVEs
 before 0:3.6.16-7.el8_8.4
0:3.6.16-7.el8_8.4
gnutls-debugsource
Red Hat:rhel_tus:8.8::baseos
From an advisory covering 13 CVEs
 before 0:3.6.16-7.el8_8.4
0:3.6.16-7.el8_8.4
gnutls-utils-debuginfo
Red Hat:rhel_tus:8.8::baseos
From an advisory covering 13 CVEs
 before 0:3.6.16-7.el8_8.4
0:3.6.16-7.el8_8.4
libtasn1
Red Hat:rhel_tus:8.8::baseos
From an advisory covering 13 CVEs
 before 0:4.13-4.el8_8.1
0:4.13-4.el8_8.1
libtasn1-debuginfo
Red Hat:rhel_tus:8.8::baseos
From an advisory covering 13 CVEs
 before 0:4.13-4.el8_8.1
0:4.13-4.el8_8.1
libtasn1-debugsource
Red Hat:rhel_tus:8.8::baseos
From an advisory covering 13 CVEs
 before 0:4.13-4.el8_8.1
0:4.13-4.el8_8.1
libtasn1-tools-debuginfo
Red Hat:rhel_tus:8.8::baseos
From an advisory covering 13 CVEs
 before 0:4.13-4.el8_8.1
0:4.13-4.el8_8.1
gnutls-c++-debuginfo
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-7.el8_8.4
0:3.6.16-7.el8_8.4
gnutls-c++-debuginfo
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 13 CVEs
 before 0:3.6.16-7.el8_8.4
0:3.6.16-7.el8_8.4
gnutls-c++-debuginfo
Red Hat:rhel_e4s:8.8::baseos
From an advisory covering 13 CVEs
 before 0:3.6.16-7.el8_8.4
0:3.6.16-7.el8_8.4
gnutls-c++-debuginfo
Red Hat:rhel_tus:8.8::baseos
From an advisory covering 13 CVEs
 before 0:3.6.16-7.el8_8.4
0:3.6.16-7.el8_8.4
gnutls-c++
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 12 CVEs
 before 0:3.8.3-4.el9_4.6
0:3.8.3-4.el9_4.6
gnutls-c++-debuginfo
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 12 CVEs
 before 0:3.8.3-4.el9_4.6
0:3.8.3-4.el9_4.6
gnutls-dane
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 12 CVEs
 before 0:3.8.3-4.el9_4.6
0:3.8.3-4.el9_4.6
gnutls-dane-debuginfo
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 12 CVEs
 before 0:3.8.3-4.el9_4.6
0:3.8.3-4.el9_4.6
gnutls-debuginfo
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 12 CVEs
 before 0:3.8.3-4.el9_4.6
0:3.8.3-4.el9_4.6
gnutls
Rocky Linux:8
From an advisory covering 11 CVEs
 before 0:3.6.16-8.el8_10.6
0:3.6.16-8.el8_10.6
gnutls
Rocky Linux:9
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el9_8
0:3.8.10-4.el9_8
gnutls
Rocky Linux:10
From an advisory covering 13 CVEs
 before 0:3.8.10-4.el10_2
0:3.8.10-4.el10_2
gnutls
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 3 CVEs
 before 3.4.17-8.23.1
3.4.17-8.23.1
gnutls
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 3 CVEs
 before 3.4.17-8.23.1
3.4.17-8.23.1
gnutls
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 4 CVEs
 before 3.3.27-3.18.1
3.3.27-3.18.1
gnutls
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 4 CVEs
 before 3.3.27-3.18.1
3.3.27-3.18.1
gnutls
SUSE:Linux Enterprise Micro 5.3
From an advisory covering 12 CVEs
 before 3.7.3-150400.24.2
3.7.3-150400.24.2
gnutls28
Ubuntu:Pro:16.04:LTS
 before 3.4.10-4ubuntu1.9+esm3, plus listed versions
3.3.15-5ubuntu23.3.18-1ubuntu13.3.20-1ubuntu13.4.9-2ubuntu13.4.10-4ubuntu1
Show 11 moreShow less
3.4.10-4ubuntu1.13.4.10-4ubuntu1.23.4.10-4ubuntu1.33.4.10-4ubuntu1.43.4.10-4ubuntu1.53.4.10-4ubuntu1.63.4.10-4ubuntu1.73.4.10-4ubuntu1.83.4.10-4ubuntu1.93.4.10-4ubuntu1.9+esm13.4.10-4ubuntu1.9+esm2
3.4.10-4ubuntu1.9+esm3
gnutls28
Ubuntu:Pro:18.04:LTS
 before 3.5.18-1ubuntu1.6+esm3, plus listed versions
3.5.8-6ubuntu33.5.17-1ubuntu13.5.17-1ubuntu33.5.18-1ubuntu13.5.18-1ubuntu1.1
Show 7 moreShow less
3.5.18-1ubuntu1.23.5.18-1ubuntu1.33.5.18-1ubuntu1.43.5.18-1ubuntu1.53.5.18-1ubuntu1.63.5.18-1ubuntu1.6+esm13.5.18-1ubuntu1.6+esm2
3.5.18-1ubuntu1.6+esm3
gnutls28
Ubuntu:Pro:20.04:LTS
 before 3.6.13-2ubuntu1.12+esm2, plus listed versions
3.6.9-5ubuntu13.6.9-5ubuntu23.6.10-53.6.11.1-23.6.11.1-2ubuntu2
Show 12 moreShow less
3.6.13-2ubuntu13.6.13-2ubuntu1.13.6.13-2ubuntu1.23.6.13-2ubuntu1.33.6.13-2ubuntu1.63.6.13-2ubuntu1.73.6.13-2ubuntu1.83.6.13-2ubuntu1.93.6.13-2ubuntu1.103.6.13-2ubuntu1.113.6.13-2ubuntu1.123.6.13-2ubuntu1.12+esm1
3.6.13-2ubuntu1.12+esm2
gnutls28
Ubuntu:22.04:LTS
 before 3.7.3-4ubuntu1.9, plus listed versions
3.7.1-5ubuntu13.7.2-2ubuntu13.7.2-4ubuntu13.7.2-5ubuntu13.7.3-4ubuntu1
Show 8 moreShow less
3.7.3-4ubuntu1.13.7.3-4ubuntu1.23.7.3-4ubuntu1.33.7.3-4ubuntu1.43.7.3-4ubuntu1.53.7.3-4ubuntu1.63.7.3-4ubuntu1.73.7.3-4ubuntu1.8
3.7.3-4ubuntu1.9
gnutls28
Ubuntu:Pro:FIPS-preview:22.04:LTS
 All versions, plus listed versions
3.7.3-4ubuntu1.2+Fips1.1
 None known
gnutls28
Ubuntu:Pro:FIPS-updates:22.04:LTS
 before 3.7.3-4ubuntu1.9+Fips1, plus listed versions
3.7.3-4ubuntu1.2+Fips1.13.7.3-4ubuntu1.3+Fips1.13.7.3-4ubuntu1.4+Fips13.7.3-4ubuntu1.5+Fips13.7.3-4ubuntu1.6+Fips13.7.3-4ubuntu1.7+Fips13.7.3-4ubuntu1.7+Fips1.13.7.3-4ubuntu1.8+Fips1.1
3.7.3-4ubuntu1.9+Fips1
gnutls28
Ubuntu:24.04:LTS
 before 3.8.3-1.1ubuntu3.6, plus listed versions
3.8.1-4ubuntu13.8.1-4ubuntu63.8.1-4ubuntu73.8.3-1ubuntu13.8.3-1.1ubuntu2
Show 6 moreShow less
3.8.3-1.1ubuntu33.8.3-1.1ubuntu3.13.8.3-1.1ubuntu3.23.8.3-1.1ubuntu3.33.8.3-1.1ubuntu3.43.8.3-1.1ubuntu3.5
3.8.3-1.1ubuntu3.6
gnutls28
Ubuntu:Pro:FIPS-updates:24.04:LTS
 before 3.8.3-1.1ubuntu3.6+Fips1.2, plus listed versions
3.8.3-1.1ubuntu3.1+Fips13.8.3-1.1ubuntu3.4+Fips13.8.3-1.1ubuntu3.4+Fips1.13.8.3-1.1ubuntu3.5+Fips1.1
3.8.3-1.1ubuntu3.6+Fips1.2
gnutls28
Ubuntu:25.10
 before 3.8.9-3ubuntu2.2, plus listed versions
3.8.9-2ubuntu33.8.9-3ubuntu13.8.9-3ubuntu23.8.9-3ubuntu2.1
3.8.9-3ubuntu2.2
gnutls28
Ubuntu:26.04:LTS
 before 3.8.12-2ubuntu1.1, plus listed versions
3.8.9-3ubuntu23.8.10-3ubuntu13.8.12-2ubuntu1
3.8.12-2ubuntu1.1
gnutls28
Ubuntu:Pro:16.04:LTS
From an advisory covering 10 CVEs
 before 3.4.10-4ubuntu1.9+esm3, plus listed versions
3.3.15-5ubuntu23.3.18-1ubuntu13.3.20-1ubuntu13.4.9-2ubuntu13.4.10-4ubuntu1
Show 11 moreShow less
3.4.10-4ubuntu1.13.4.10-4ubuntu1.23.4.10-4ubuntu1.33.4.10-4ubuntu1.43.4.10-4ubuntu1.53.4.10-4ubuntu1.63.4.10-4ubuntu1.73.4.10-4ubuntu1.83.4.10-4ubuntu1.93.4.10-4ubuntu1.9+esm13.4.10-4ubuntu1.9+esm2
3.4.10-4ubuntu1.9+esm3
gnutls28
Ubuntu:Pro:18.04:LTS
From an advisory covering 10 CVEs
 before 3.5.18-1ubuntu1.6+esm3, plus listed versions
3.5.8-6ubuntu33.5.17-1ubuntu13.5.17-1ubuntu33.5.18-1ubuntu13.5.18-1ubuntu1.1
Show 7 moreShow less
3.5.18-1ubuntu1.23.5.18-1ubuntu1.33.5.18-1ubuntu1.43.5.18-1ubuntu1.53.5.18-1ubuntu1.63.5.18-1ubuntu1.6+esm13.5.18-1ubuntu1.6+esm2
3.5.18-1ubuntu1.6+esm3
gnutls28
Ubuntu:Pro:20.04:LTS
From an advisory covering 10 CVEs
 before 3.6.13-2ubuntu1.12+esm2, plus listed versions
3.6.9-5ubuntu13.6.9-5ubuntu23.6.10-53.6.11.1-23.6.11.1-2ubuntu2
Show 12 moreShow less
3.6.13-2ubuntu13.6.13-2ubuntu1.13.6.13-2ubuntu1.23.6.13-2ubuntu1.33.6.13-2ubuntu1.63.6.13-2ubuntu1.73.6.13-2ubuntu1.83.6.13-2ubuntu1.93.6.13-2ubuntu1.103.6.13-2ubuntu1.113.6.13-2ubuntu1.123.6.13-2ubuntu1.12+esm1
3.6.13-2ubuntu1.12+esm2
gnutls
openSUSE:Tumbleweed
From an advisory covering 13 CVEs
 before 3.8.13-1.1
3.8.13-1.1

History

History
RecordedChangedSources
affectedEUVD, NVD, OSV
factsCVE List
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-33846 is a high vulnerability (CVSS 7.5) in Red Hat Cert Manager Support For Red Hat Openshift Release 1.17, published May 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.26%, the 69th percentile. Fixed in gnutls 3.8.13-r0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 74 package rows and 1 reference. The JSON record has them. Left out on purpose, here and in the API, to keep responses small: 5 source records.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open