CVE-2026-33845

A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service.

A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service.

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, and other required structures. The project strives to provide a secure communications back-end, simple to use and integrated with the rest of the base Linux libraries. A back-end designed to work and be secure out of the box, keeping the complexity of TLS and PKI out of application code.

Security Fix(es):

A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service.(CVE-2026-33845)

Please update the gnutls packages to provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

Security Fix(es):

• gnutls: Add more checks to DTLS reassembly (CVE-2026-33846)
• gnutls: Fix qsort comparator in DTLS reassembly (CVE-2026-42009)
• gnutls: Fix crashing on an underflow with a DTLS datagram (CVE-2026-33845)
• gnutls: Fix RSA-PSK identity truncation (CVE-2026-42010)
• gnutls: Fix case-sensitivity of domain name comparison in name constraints (CVE-2026-3833)
• gnutls: Fix intersecting empty constraints (CVE-2026-42011)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

Security Fix(es):

• gnutls: Fix qsort comparator in DTLS reassembly (CVE-2026-42009)
• gnutls: Fix crashing on an underflow with a DTLS datagram (CVE-2026-33845)
• gnutls: Fix RSA-PSK identity truncation (CVE-2026-42010)
• gnutls: Fix case-sensitivity of domain name comparison in name constraints (CVE-2026-3833)
• gnutls: Fix intersecting empty name constraints (CVE-2026-42011)
• gnutls: Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly (CVE-2026-33846)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

Security Fix(es):

• gnutls: Fix qsort comparator in DTLS reassembly (CVE-2026-42009)
• gnutls: Fix crashing on an underflow with a DTLS datagram (CVE-2026-33845)
• gnutls: Fix RSA-PSK identity truncation (CVE-2026-42010)
• gnutls: Fix case-sensitivity of domain name comparison in name constraints (CVE-2026-3833)
• gnutls: Fix intersecting empty name constraints (CVE-2026-42011)
• gnutls: Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly (CVE-2026-33846)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2026-33845 in the rootio-gnutls28 package for Root:Debian:12. Multiple fixed versions available.

A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service.

Please update the gnutls packages to provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

Security Fix(es):

• gnutls: Add more checks to DTLS reassembly (CVE-2026-33846)
• gnutls: Fix qsort comparator in DTLS reassembly (CVE-2026-42009)
• gnutls: Fix crashing on an underflow with a DTLS datagram (CVE-2026-33845)
• gnutls: Fix RSA-PSK identity truncation (CVE-2026-42010)
• gnutls: Fix case-sensitivity of domain name comparison in name constraints (CVE-2026-3833)
• gnutls: Fix intersecting empty constraints (CVE-2026-42011)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library,
which implements cryptographic algorithms and protocols such as SSL, TLS, and
DTLS.

Security Fix(es):

• gnutls: Fix qsort comparator in DTLS reassembly (CVE-2026-42009)
• gnutls: Fix crashing on an underflow with a DTLS datagram

(CVE-2026-33845)

• gnutls: Fix RSA-PSK identity truncation (CVE-2026-42010)
• gnutls: Fix case-sensitivity of domain name comparison in name

constraints (CVE-2026-3833)

• gnutls: Fix intersecting empty name constraints (CVE-2026-42011)
• gnutls: Denial of Service via heap buffer overflow in DTLS handshake

fragment reassembly (CVE-2026-33846)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library,
which implements cryptographic algorithms and protocols such as SSL, TLS, and
DTLS.

Security Fix(es):

• gnutls: Fix qsort comparator in DTLS reassembly (CVE-2026-42009)
• gnutls: Fix crashing on an underflow with a DTLS datagram (CVE-2026-33845)
• gnutls: Fix RSA-PSK identity truncation (CVE-2026-42010)
• gnutls: Fix case-sensitivity of domain name comparison in name constraints (CVE-2026-3833)
• gnutls: Fix intersecting empty name constraints (CVE-2026-42011)
• gnutls: Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly (CVE-2026-33846)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service.

• CVE-2026-33845: fix DTLS handshake fragment reassembly integer underflow and heap overrun by tracking frag_length instead of end_offset

• CVE-2026-33845: fix DTLS handshake parsing integer underflow leading to OOB read

• CVE-2026-33845: fix DTLS handshake fragment reassembly integer underflow and heap overrun by tracking frag_length instead of end_offset

• CVE-2026-33845: fix DTLS handshake parsing integer underflow leading to OOB read

• CVE-2026-33845: fix DTLS handshake parsing integer underflow leading to OOB read

• CVE-2026-33845: fix integer underflow in DTLS handshake reassembly that allowed a remote heap overrun via crafted zero-length fragments

• CVE-2026-33845: fix DTLS handshake fragment reassembly integer underflow and heap overrun by tracking frag_length instead of end_offset

• CVE-2026-33845: fix integer underflow and remote heap overrun in DTLS handshake reassembly by tracking start_offset and frag_length instead of an inclusive [start_offset, end_offset] range

• Rebased onto the vendor 3.3.29-9.0.3.el7_9 sources
• CVE-2026-5260: guard PKCS#11 RSA decryption against short-ciphertext heap overread (TuxCare fix retained)
• CVE-2026-42014 and CVE-2026-42015 are fixed by the vendor in this build
• CVE-2026-42011 is not applicable to this baseline per the vendor assessment
• CVE-2026-33845, CVE-2026-33846, CVE-2026-3833, CVE-2026-42009, CVE-2026-42012 and CVE-2026-42013 are now fixed by the vendor; the TuxCare duplicates are dropped
• CVE-2026-3833 follow-up: the vendor's email_matches() no longer matches a bare-domain rfc822Name against a bare-domain constraint of the same length, which 3.3.29 did; restore that comparison, case-insensitively, and add the assertions to tests/name-constraints.c

• Rebased onto the vendor 3.3.29-9.0.3.el7_9 sources
• CVE-2026-5260: guard PKCS#11 RSA decryption against short-ciphertext heap overread (TuxCare fix retained)
• CVE-2026-42014 and CVE-2026-42015 are fixed by the vendor in this build
• CVE-2026-42011 is not applicable to this baseline per the vendor assessment
• CVE-2026-33845, CVE-2026-33846, CVE-2026-3833, CVE-2026-42009, CVE-2026-42012 and CVE-2026-42013 are now fixed by the vendor; the TuxCare duplicates are dropped
• CVE-2026-3833 follow-up: the vendor's email_matches() no longer matches a bare-domain rfc822Name against a bare-domain constraint of the same length, which 3.3.29 did; restore that comparison, case-insensitively, and add the assertions to tests/name-constraints.c

• Rebased onto the vendor 3.3.29-9.0.3.el7_9 sources
• CVE-2026-5260: guard PKCS#11 RSA decryption against short-ciphertext heap overread (TuxCare fix retained)
• CVE-2026-42014 and CVE-2026-42015 are fixed by the vendor in this build
• CVE-2026-42011 is not applicable to this baseline per the vendor assessment
• CVE-2026-33845, CVE-2026-33846, CVE-2026-3833, CVE-2026-42009, CVE-2026-42012 and CVE-2026-42013 are now fixed by the vendor; the TuxCare duplicates are dropped
• CVE-2026-3833 follow-up: the vendor's email_matches() no longer matches a bare-domain rfc822Name against a bare-domain constraint of the same length, which 3.3.29 did; restore that comparison, case-insensitively, and add the assertions to tests/name-constraints.c

These are all security issues fixed in the gnutls-3.8.13-1.1 package on the GA media of openSUSE Tumbleweed.

This update for gnutls fixes the following issues

• CVE-2026-3832: cert-session: fix multi-entry OCSP revocation bypass (bsc#1263706).
• CVE-2026-3833: x509/name-constraints: compare domain names case-insensitive (bsc#1263707).
• CVE-2026-5260: lib/pkcs11_privkey: guard against overreading on short ciphertexts (bsc#1263715).
• CVE-2026-5419: gnutls_cipher_decrypt3: make PKCS#7 unpadding branch free (bsc#1263716).
• CVE-2026-33845: buffers: switch from end_offset over to frag_length (bsc#1263704).
• CVE-2026-33846: buffers: add more checks to DTLS reassembly (bsc#1263705).
• CVE-2026-42009: lib/buffers: ensure packets have differing sequence numbers (bsc#1263708).
• CVE-2026-42010: lib/auth/rsa_psk: fix binary PSK identity lookup (bsc#1263709).
• CVE-2026-42011: x509/name_constraints: fix intersecting empty constraints (bsc#1263710).
• CVE-2026-42012: x509/hostname-verify: make URI/SRV SAN preclude CN fallback (bsc#1263711).
• CVE-2026-42013: x509: prevent fallback on oversized SAN (bsc#1263712).
• CVE-2026-42014: pkcs11_write: fix UAF and leak in gnutls_pkcs11_token_set_pin (bsc#1263713).
• CVE-2026-42015: x509/pkcs12_bag: fix off-by-one in bag element bounds chec (bsc#1263714).

Root has patched CVE-2026-33845 in the rootio-gnutls28 package for Root:Debian:13. Multiple fixed versions available.

This update for gnutls fixes the following issues

• CVE-2026-3833: x509/name-constraints: compare domain names case-insensitive (bsc#1263707).
• CVE-2026-5260: lib/pkcs11_privkey: guard against overreading on short ciphertexts (bsc#1263715).
• CVE-2026-33845: buffers: switch from end_offset over to frag_length (bsc#1263704).
• CVE-2026-33846: buffers: add more checks to DTLS reassembly (bsc#1263705).
• CVE-2026-42009: lib/buffers: ensure packets have differing sequence numbers (bsc#1263708).
• CVE-2026-42010: lib/auth/rsa_psk: fix binary PSK identity lookup (bsc#1263709).
• CVE-2026-42011: x509/name_constraints: fix intersecting empty constraints (bsc#1263710).
• CVE-2026-42012: x509/hostname-verify: make URI/SRV SAN preclude CN fallback (bsc#1263711).
• CVE-2026-42013: x509: prevent fallback on oversized SAN (bsc#1263712).
• CVE-2026-42014: pkcs11_write: fix UAF and leak in gnutls_pkcs11_token_set_pin (bsc#1263713).
• CVE-2026-42015: x509/pkcs12_bag: fix off-by-one in bag element bounds chec (bsc#1263714).

This update for gnutls fixes the following issues

• CVE-2026-3833: x509/name-constraints: compare domain names case-insensitive (bsc#1263707).
• CVE-2026-5260: lib/pkcs11_privkey: guard against overreading on short ciphertexts (bsc#1263715).
• CVE-2026-5419: gnutls_cipher_decrypt3: make PKCS#7 unpadding branch free (bsc#1263716).
• CVE-2026-33845: buffers: switch from end_offset over to frag_length (bsc#1263704).
• CVE-2026-33846: buffers: add more checks to DTLS reassembly (bsc#1263705).
• CVE-2026-42009: lib/buffers: ensure packets have differing sequence numbers (bsc#1263708).
• CVE-2026-42010: lib/auth/rsa_psk: fix binary PSK identity lookup (bsc#1263709).
• CVE-2026-42011: x509/name_constraints: fix intersecting empty constraints (bsc#1263710).
• CVE-2026-42012: x509/hostname-verify: make URI/SRV SAN preclude CN fallback (bsc#1263711).
• CVE-2026-42013: x509: prevent fallback on oversized SAN (bsc#1263712).
• CVE-2026-42014: pkcs11_write: fix UAF and leak in gnutls_pkcs11_token_set_pin (bsc#1263713).
• CVE-2026-42015: x509/pkcs12_bag: fix off-by-one in bag element bounds chec (bsc#1263714).

This update for gnutls fixes the following issues

• CVE-2026-3832: cert-session: fix multi-entry OCSP revocation bypass (bsc#1263706).
• CVE-2026-3833: x509/name-constraints: compare domain names case-insensitive (bsc#1263707).
• CVE-2026-5260: lib/pkcs11_privkey: guard against overreading on short ciphertexts (bsc#1263715).
• CVE-2026-5419: gnutls_cipher_decrypt3: make PKCS#7 unpadding branch free (bsc#1263716).
• CVE-2026-33845: buffers: switch from end_offset over to frag_length (bsc#1263704).
• CVE-2026-33846: buffers: add more checks to DTLS reassembly (bsc#1263705).
• CVE-2026-42009: lib/buffers: ensure packets have differing sequence numbers (bsc#1263708).
• CVE-2026-42010: lib/auth/rsa_psk: fix binary PSK identity lookup (bsc#1263709).
• CVE-2026-42011: x509/name_constraints: fix intersecting empty constraints (bsc#1263710).
• CVE-2026-42012: x509/hostname-verify: make URI/SRV SAN preclude CN fallback (bsc#1263711).
• CVE-2026-42013: x509: prevent fallback on oversized SAN (bsc#1263712).
• CVE-2026-42014: pkcs11_write: fix UAF and leak in gnutls_pkcs11_token_set_pin (bsc#1263713).
• CVE-2026-42015: x509/pkcs12_bag: fix off-by-one in bag element bounds chec (bsc#1263714).

This update for gnutls fixes the following issues

• CVE-2026-3833: x509/name-constraints: compare domain names case-insensitive (bsc#1263707).
• CVE-2026-5260: lib/pkcs11_privkey: guard against overreading on short ciphertexts (bsc#1263715).
• CVE-2026-5419: gnutls_cipher_decrypt3: make PKCS#7 unpadding branch free (bsc#1263716).
• CVE-2026-33845: buffers: switch from end_offset over to frag_length (bsc#1263704).
• CVE-2026-33846: buffers: add more checks to DTLS reassembly (bsc#1263705).
• CVE-2026-42009: lib/buffers: ensure packets have differing sequence numbers (bsc#1263708).
• CVE-2026-42010: lib/auth/rsa_psk: fix binary PSK identity lookup (bsc#1263709).
• CVE-2026-42011: x509/name_constraints: fix intersecting empty constraints (bsc#1263710).
• CVE-2026-42012: x509/hostname-verify: make URI/SRV SAN preclude CN fallback (bsc#1263711).
• CVE-2026-42013: x509: prevent fallback on oversized SAN (bsc#1263712).
• CVE-2026-42014: pkcs11_write: fix UAF and leak in gnutls_pkcs11_token_set_pin (bsc#1263713).
• CVE-2026-42015: x509/pkcs12_bag: fix off-by-one in bag element bounds chec (bsc#1263714).

This update for gnutls fixes the following issues

• CVE-2026-3832: cert-session: fix multi-entry OCSP revocation bypass (bsc#1263706).
• CVE-2026-3833: x509/name-constraints: compare domain names case-insensitive (bsc#1263707).
• CVE-2026-5260: lib/pkcs11_privkey: guard against overreading on short ciphertexts (bsc#1263715).
• CVE-2026-5419: gnutls_cipher_decrypt3: make PKCS#7 unpadding branch free (bsc#1263716).
• CVE-2026-33845: buffers: switch from end_offset over to frag_length (bsc#1263704).
• CVE-2026-33846: buffers: add more checks to DTLS reassembly (bsc#1263705).
• CVE-2026-42009: lib/buffers: ensure packets have differing sequence numbers (bsc#1263708).
• CVE-2026-42010: lib/auth/rsa_psk: fix binary PSK identity lookup (bsc#1263709).
• CVE-2026-42011: x509/name_constraints: fix intersecting empty constraints (bsc#1263710).
• CVE-2026-42012: x509/hostname-verify: make URI/SRV SAN preclude CN fallback (bsc#1263711).
• CVE-2026-42013: x509: prevent fallback on oversized SAN (bsc#1263712).
• CVE-2026-42014: pkcs11_write: fix UAF and leak in gnutls_pkcs11_token_set_pin (bsc#1263713).
• CVE-2026-42015: x509/pkcs12_bag: fix off-by-one in bag element bounds chec (bsc#1263714).

This update for gnutls fixes the following issues

• CVE-2026-3833: x509/name-constraints: compare domain names case-insensitive (bsc#1263707).
• CVE-2026-5260: lib/pkcs11_privkey: guard against overreading on short ciphertexts (bsc#1263715).
• CVE-2026-5419: gnutls_cipher_decrypt3: make PKCS#7 unpadding branch free (bsc#1263716).
• CVE-2026-33845: buffers: switch from end_offset over to frag_length (bsc#1263704).
• CVE-2026-33846: buffers: add more checks to DTLS reassembly (bsc#1263705).
• CVE-2026-42009: lib/buffers: ensure packets have differing sequence numbers (bsc#1263708).
• CVE-2026-42010: lib/auth/rsa_psk: fix binary PSK identity lookup (bsc#1263709).
• CVE-2026-42011: x509/name_constraints: fix intersecting empty constraints (bsc#1263710).
• CVE-2026-42012: x509/hostname-verify: make URI/SRV SAN preclude CN fallback (bsc#1263711).
• CVE-2026-42013: x509: prevent fallback on oversized SAN (bsc#1263712).
• CVE-2026-42014: pkcs11_write: fix UAF and leak in gnutls_pkcs11_token_set_pin (bsc#1263713).
• CVE-2026-42015: x509/pkcs12_bag: fix off-by-one in bag element bounds chec (bsc#1263714).

This update for gnutls fixes the following issues

• CVE-2026-33845: buffers: switch from end_offset over to frag_length (bsc#1263704).
• CVE-2026-33846: buffers: add more checks to DTLS reassembly (bsc#1263705).
• CVE-2026-42009: lib/buffers: ensure packets have differing sequence numbers (bsc#1263708).

This update for gnutls fixes the following issues

• CVE-2026-33845: buffers: switch from end_offset over to frag_length (bsc#1263704).
• CVE-2026-33846: buffers: add more checks to DTLS reassembly (bsc#1263705).
• CVE-2026-42009: lib/buffers: ensure packets have differing sequence numbers (bsc#1263708).

This update for gnutls fixes the following issues

• CVE-2025-14831: excessive resource consumption when verifying specially crafted malicious certificates containing a large number of name constraints and SANs (bsc#1257960).
• CVE-2026-3833: incorrectly accepted domain names due to comparison during name constraints processing being case-sensitive (bsc#1263707).
• CVE-2026-5260: heap overread when processing extremely short premaster secret as part of an RSA key exchange (bsc#1263715).
• CVE-2026-33845: integer overflow and heap overrun when parsing fragments with zero length and non-zero offset during DTLS handshake (bsc#1263704).
• CVE-2026-33846: heap overwrite during DTLS handshake fragment reassembly due to missing validations and checks (bsc#1263705).
• CVE-2026-42009: undefined behavior resulting in a DoS when handling DTLS packets with duplicate sequence numbers (bsc#1263708).
• CVE-2026-42010: authentication bypass when processing a PSK username with a NUL-character (bsc#1263709).
• CVE-2026-42011: name constraint bypass leading to acceptance of invalid certificates during certificate validation (bsc#1263710).
• CVE-2026-42012: spoofing of legitimate services and sensitive information interception via specially crafted certificates containing URIs or SRV SANs. (bsc#1263711).
• CVE-2026-42013: certificate validation bypass when validating certificates with an oversized SAN (bsc#1263712).
• CVE-2026-42014: use-after-free when an attacker attempts to change the PIN with a NULL old PIN for a token that lacks a protected authentication path (bsc#1263713).
• CVE-2026-42015: memory corruption when appending to a PKCS#12 bag that already contains 32 elements (bsc#1263714).

Joshua Rogers discovered that GnuTLS did not properly handle malformed DTLS handshake fragments in certain cases. A remote attacker could possibly use this issue to obtain sensitive information, or cause a denial of service. (CVE-2026-33845)

Haruto Kimura, Oscar Reparaz, and Zou Dikai discovered that GnuTLS did not properly validate DTLS handshake fragment lengths in certain cases. A remote attacker could possibly use this issue to cause GnuTLS to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-33846)

Oleh Konko and Joshua Rogers discovered that GnuTLS did not properly validate OCSP responses in certain cases. A remote attacker could possibly use this issue to bypass certificate revocation checks, leading to a machine-in-the-middle attack. (CVE-2026-3832)

Oleh Konko and Joshua Rogers discovered that GnuTLS did not properly handle case-insensitive name constraints in certain cases. A remote attacker could possibly use this issue to bypass certificate validation, leading to a machine-in-the-middle attack. (CVE-2026-3833)

Joshua Rogers discovered that GnuTLS did not properly order DTLS packets with duplicate sequence numbers in certain cases. A remote attacker could possibly use this issue to cause GnuTLS to crash, resulting in a denial of service. (CVE-2026-42009)

Joshua Rogers discovered that GnuTLS did not properly handle usernames containing NUL characters in certain RSA-PSK configurations. A remote attacker could possibly use this issue to bypass authentication and gain unintended access to services. (CVE-2026-42010)

Haruto Kimura discovered that GnuTLS did not properly apply permitted name constraints in certain certificate validation paths. A remote attacker could possibly use this issue to bypass certificate validation, leading to a machine-in-the-middle attack. (CVE-2026-42011)

Oleh Konko discovered that GnuTLS incorrectly fell back to Common Name checks for certain URI and SRV subject alternative names. A remote attacker could possibly use this issue to bypass certificate validation, leading to a machine-in-the-middle attack. (CVE-2026-42012)

Haruto Kimura and Joshua Rogers discovered that GnuTLS incorrectly fell back to Common Name checks when subject alternative names were oversized. A remote attacker could possibly use this issue to bypass certificate validation, leading to a machine-in-the-middle attack. (CVE-2026-42013)

Luigino Camastra and Joshua Rogers discovered that GnuTLS had a use-after-free issue when changing PKCS#11 token security officer PINs in certain cases. An attacker could possibly use this issue to cause GnuTLS to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-42014)

Zou Dikai discovered that GnuTLS did not properly validate PKCS#12 bag sizes in certain cases. An attacker could possibly use this issue to cause GnuTLS to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-42015)

Joshua Rogers discovered that GnuTLS did not properly handle very short premaster secrets in certain RSA key exchange cases with PKCS#11-backed server keys. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-5260)

Doria Tang discovered that GnuTLS did not perform PKCS#7 padding checks in constant time in certain cases. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-5419)