4445 matches found
CVE-2026-33846
GnuTLS DTLS handshake fragment reassembly (merge_handshake_packet) fails to enforce consistent message_length across fragments, enabling a heap-based out-of-bounds write when fragments with conflicting lengths are received. This remote, unauthenticated vulnerability can cause application crashes ...
CVE-2026-33846
A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in mergehandshakepacket where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the messagelength field remains...
CVE-2026-33846
A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in mergehandshakepacket where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the messagelength field remains...
GnuTLS 安全漏洞
GnuTLS is an open-source, free security communication library developed by GnuTLS that enables the implementation of SSL, TLS, and DTLS protocols. GnuTLS has a security vulnerability, which stems from the mergehandshakepacket function in the DTLS handshake reassembly logic not verifying the...
Astra Linux - уязвимость в gnutls28
A NULL pointer dereference flaw was discovered in GnuTLS. Since Nettle’s hash update functions internally call memcpy, using zero-length inputs may lead to undefined behavior. This flaw can result in a denial of service after authentication in rare circumstances...
Astra Linux - уязвимость в gnutls28
A vulnerability has been discovered in gnutls. This security flaw occurs due to a double-free error that occurs during the verification of pkcs7 signatures in the gnutlspkcs7verify function...
Astra Linux - уязвимость в gnutls28
A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name SAN entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1deletestructure on an ASN.1 node it do...
Astra Linux - уязвимость в gnutls28
A NULL pointer dereference flaw was discovered in the GnuTLS software in the gnutlsfigurecommonciphersuite function...
Astra Linux - уязвимость в gnutls28
A vulnerability was discovered in GnuTLS. The response times to malformed ciphertexts in the RSA-PSK ClientKeyExchange differ from those of ciphertexts with correct PKCS1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack during the RSA-PSK key exchange,...
Astra Linux - уязвимость в gnutls28
A vulnerability was identified: the response times for malformed ciphertexts in RSA-PSK ClientKeyExchange differ from those of ciphertexts with correct PKCS1 v1.5 padding...
Astra Linux - уязвимость в gnutls28
A issue was discovered in GnuTLS before version 3.6.15. A server can cause a NULL pointer dereferencing in a TLS 1.3 client if a norenegotiation alert is sent at an unexpected time, resulting in an invalid second handshake. The crash occurs during the application’s error handling process, where t...
Astra Linux - уязвимость в samba
In Samba, GnuTLS’ gnutlsrnd function may fail, resulting in predictable random values...
Astra Linux - уязвимость в gnutls28
A flaw was discovered in GnuTLS. This vulnerability allows for a denial of service attack through excessive CPU usage and memory consumption, caused by specially crafted malicious certificates that contain a large number of name constraints and Subject Alternative Names SANs...
Astra Linux - уязвимость в gnutls28
A timing side-channel vulnerability in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be used to recover the key encrypted in the RSA ciphertext across a network, in a Bleichenbacher-style attack. To successfully decrypt the data, the attacker would...
Astra Linux - уязвимость в gnutls28
A flaw was discovered in gnutls. A use-after-free issue in the client’s sending of the keyshare extension may lead to memory corruption and other related issues...
[slackware-security] gnutls
New gnutls packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/gnutls-3.8.13-i586-1slack15.0.txz: Upgraded. This update fixes a security issue: Add more checks to DTLS reassembly. Previously, gnut...
Slackware Linux 15.0 / current gnutls Vulnerability (SSA:2026-122-02)
The version of gnutls installed on the remote host is prior to 3.8.13. It is, therefore, affected by a vulnerability as referenced in the SSA:2026-122-02 advisory. New gnutls packages are available for Slackware 15.0 and -current to fix a security issue. Tenable has extracted the preceding...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: gnutls: gnutls-3.8.13-1.hum1 aarch64, x8664 gnutls-c++-3.8.13-1.hum1 aarch64, x8664 gnutls-dane-3.8.13-1.hum1 aarch64, x8664 gnutls-devel-3.8.13-1.hum1 aarch64, x8664 gnutls-fips-3.8.13-1.hum1...
SUSE CVE-2026-3832
A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online Certificate Status Protocol OCSP response during a TLS handshake. Due to a logic error in how gnutls processes multi-record OCSP responses, a client with OCSP verification enabl...
SUSE CVE-2026-3833
A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of nameConstraints labels, specifically for dNSName DNS or rfc822Name email constraints within excludedSubtrees or permittedSubtrees. A remote attacker can exploit this by crafting a leaf...