Linux · Security advisory · May 4, 2026
RHSA-2026:26409: gnutls security update
RHSA-2026:26409, released May 4, 2026, fixes 13 CVEs in gnutls (version 3.8.9-9.el10_0.19). None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent
CVEs closed
13
1 rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0207
81st percentile
Priority of the 13 CVEs
Patch now 0
Urgent 1
High 12
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| gnutls | RHEL 10 | 3.8.9-9.el10_0.19 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| Urgent | CVE-2026-33845 | gnutls28: A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to a... | 9.1 | 0.0207 | None reported | |
| High | CVE-2026-42009 | Gnutls: gnutls: denial of service via dtls packet reordering vulnerability | 8.2 | 0.0134 | None reported | |
| High | CVE-2026-33846 | gnutls28: A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS | 8.2 | 0.0126 | None reported | |
| High | CVE-2026-42010 | Gnutls: gnutls: authentication bypass via nul character in username | 9.8 | 0.0105 | None reported | |
| High | CVE-2026-3832 | gnutls28: A flaw was found in gnutls | 8.2 | 0.0080 | None reported | |
| High | CVE-2026-5260 | gnutls28: A flaw was found in libgnutls | 8.2 | 0.0077 | None reported | |
| High | CVE-2026-42015 | Gnutls: gnutls: memory corruption due to off-by-one error in pkcs#12 bag handling | 8.2 | 0.0073 | None reported | |
| High | CVE-2026-3833 | gnutls28: A flaw was found in gnutls | 8.2 | 0.0057 | None reported | |
| High | CVE-2026-5419 | Guntls: gnutls: information disclosure via timing side-channel in pkcs#7 padding removal | 8.2 | 0.0054 | None reported | |
| High | CVE-2026-42011 | Gnutls: gnutls: security bypass due to incorrect name constraint handling | 8.2 | 0.0048 | None reported | |
| High | CVE-2026-42013 | Gnutls: gnutls: certificate validation bypass due to oversized subject alternative name | 8.2 | 0.0042 | None reported | |
| High | CVE-2026-42012 | gnutls28: A flaw was found in gnutls | 8.2 | 0.0037 | None reported | |
| High | CVE-2026-42014 | Gnutls: fix use-after-free in gnutls_pkcs11_token_set_pin | 8.2 | 0.0015 | None reported |
Showing 1 to 13 of 13
1