# ALSA-2026:20611: Security update for 5 packages

ALSA-2026:20611, released May 26, 2026, fixes 11 CVEs across 5 products. None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/alsa-2026-20611
- Platform: Linux
- Released: May 26, 2026
- Priority: Urgent (Closes CVE-2026-33845, rated Critical)
- CVEs: 11, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/ALSA-2026:20611

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [gnutls](https://patchblox.com/security/data/product/linux/gnutls.md) | almalinux 8 | 3.6.16-8.el8_10.6 |
| [gnutls-c++](https://patchblox.com/security/data/product/linux/gnutls-c.md) | almalinux 8 | 3.6.16-8.el8_10.6 |
| [gnutls-dane](https://patchblox.com/security/data/product/linux/gnutls-dane.md) | almalinux 8 | 3.6.16-8.el8_10.6 |
| [gnutls-devel](https://patchblox.com/security/data/product/linux/gnutls-devel.md) | almalinux 8 | 3.6.16-8.el8_10.6 |
| [gnutls-utils](https://patchblox.com/security/data/product/linux/gnutls-utils.md) | almalinux 8 | 3.6.16-8.el8_10.6 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-33845](https://patchblox.com/security/data/cve/CVE-2026-33845.md) | Urgent | gnutls28: A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to a... | 9.1 | 0.0207 |  |
| [CVE-2026-42009](https://patchblox.com/security/data/cve/CVE-2026-42009.md) | High | Gnutls: gnutls: denial of service via dtls packet reordering vulnerability | 8.2 | 0.0134 |  |
| [CVE-2026-33846](https://patchblox.com/security/data/cve/CVE-2026-33846.md) | High | gnutls28: A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS | 8.2 | 0.0126 |  |
| [CVE-2026-42010](https://patchblox.com/security/data/cve/CVE-2026-42010.md) | High | Gnutls: gnutls: authentication bypass via nul character in username | 9.8 | 0.0105 |  |
| [CVE-2026-5260](https://patchblox.com/security/data/cve/CVE-2026-5260.md) | High | gnutls28: A flaw was found in libgnutls | 8.2 | 0.0077 |  |
| [CVE-2026-42015](https://patchblox.com/security/data/cve/CVE-2026-42015.md) | High | Gnutls: gnutls: memory corruption due to off-by-one error in pkcs#12 bag handling | 8.2 | 0.0073 |  |
| [CVE-2026-3833](https://patchblox.com/security/data/cve/CVE-2026-3833.md) | High | gnutls28: A flaw was found in gnutls | 8.2 | 0.0057 |  |
| [CVE-2026-42011](https://patchblox.com/security/data/cve/CVE-2026-42011.md) | High | Gnutls: gnutls: security bypass due to incorrect name constraint handling | 8.2 | 0.0048 |  |
| [CVE-2026-42013](https://patchblox.com/security/data/cve/CVE-2026-42013.md) | High | Gnutls: gnutls: certificate validation bypass due to oversized subject alternative name | 8.2 | 0.0042 |  |
| [CVE-2026-42012](https://patchblox.com/security/data/cve/CVE-2026-42012.md) | High | gnutls28: A flaw was found in gnutls | 8.2 | 0.0037 |  |
| [CVE-2026-42014](https://patchblox.com/security/data/cve/CVE-2026-42014.md) | High | Gnutls: fix use-after-free in gnutls_pkcs11_token_set_pin | 8.2 | 0.0015 |  |

---

Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo