GnuTLS Multiple Vulnerabilities Advisory: Certificate Validation Bypass, Heap Overflow, CVE-2025/2026

Vulnerability Overview The GnuTLS Transport Layer Security Library contains multiple security vulnerabilities involving certificate validation, memory management, and protocol implementation. These vulnerabilities may lead to security issues such as privilege escalation, information disclosure, and denial of service. Affected Scope Certificate Validation Issues: Multiple vulnerabilities involve issues during the certificate validation process, such as certificate chain verification and certificate revocation checks. Memory Management Issues: Some vulnerabilities involve memory overflows and buffer overflows, which may lead to program crashes or execution of malicious code. Protocol Implementation Issues: Vulnerabilities in the TLS/DTLS protocol implementation may lead to security issues such as man-in-the-middle attacks and session hijacking. Remediation Version Upgrade: The remediation for most vulnerabilities is to upgrade to GnuTLS version 3.8.13 or later. Apply Patches: For specific vulnerabilities, it is recommended to apply the corresponding patches. For example, for CVE-2020-13777, it is recommended to upgrade to GnuTLS 3.6.14 or later. Configuration Adjustments: Some vulnerabilities can be mitigated by adjusting configurations, such as disabling certain insecure features or protocols. Vulnerability Details CVE-2026-42014 Description: When changing the Security Officer PIN, if the provided token lacks a protected authentication path, it may lead to privilege escalation. Remediation: Upgrade to GnuTLS 3.8.13 or later. CVE-2026-42013 Description: When validating a certificate containing a Subject Alternative Name that is too large, the system may fall back to checking DNS hostnames, leading to potential misuse. Remediation: Upgrade to GnuTLS 3.8.13 or later. CVE-2026-42012 Description: When validating a certificate containing a URI or SRV Subject Alternative Name, the system may fall back to checking DNS hostnames, leading to potential misuse. Remediation: Upgrade to GnuTLS 3.8.13 or later. CVE-2026-42011 Description: If a previous CA has excluded name constraints, name constraints may be incorrectly ignored, leading to a name constraint bypass. Remediation: Upgrade to GnuTLS 3.8.13 or later. CVE-2026-3833 Description: The domain name portion may be case-sensitive when handling name constraints, leading to the erroneous acceptance of domains that should be rejected. Remediation: Upgrade to GnuTLS 3.8.13 or later. CVE-2026-42010 Description: A server configured for RSA-PSK may incorrectly match usernames containing NULL characters, leading to authentication bypass. Remediation: Upgrade to GnuTLS 3.8.13 or later. CVE-2026-33845 Description: A remote-triggerable underflow in the DTLS reassembly code may lead to a heap overflow. Remediation: Upgrade to GnuTLS 3.8.13 or later. CVE-2026-42009 Description: The comparison function used for ordering DTLS packets may exhibit undefined behavior due to duplicate sequence numbers. Remediation: Upgrade to GnuTLS 3.8.13 or later. CVE-2026-5419 Description: Padding checks after decryption may be inconsistent, potentially leading to side-channel attacks. Remediation: Upgrade to GnuTLS 3.8.13 or later. CVE-2026-3832 Description: When validating multi-entry OCSP responses, the system may incorrectly check the first entry, leading to a revocation bypass. Remediation: Upgrade to GnuTLS 3.8.13 or later. CVE-2026-42015 Description: When extracting from a PKCS#12 package, it may exceed internal array boundaries. Remediation: Upgrade to GnuTLS 3.8.13 or later. CVE-2026-5260 Description: When using RSA keys with a PKCS#11 token, an extra short pre-master secret sent by the client may lead to a heap overflow. Remediation: Upgrade to GnuTLS 3.8.13 or later. CVE-2026-33846 Description: GnuTLS does not check the consistency of message lengths for DTLS fragments, which may lead to a heap overflow. Remediation: Upgrade to GnuTLS 3.8.13 or later. CVE-2025-14831 Description: Validating a certificate with pathological attribute name constraints may lead to a denial of service. Remediation: Upgrade to GnuTLS 3.8.12 or later. CVE-2026-1584 Description: During TLS 1.3 renegotiation, an invalid PSK binding value may lead to a denial of service. Remediation: Upgrade to GnuTLS 3.8.12 or later. CVE-2025-9820 Description: During the initialization of a PKCS#11 token, it may write beyond stack-allocated memory, leading to a stack overflow. Remediation: Upgrade to GnuTLS 3.8.10 or later. CVE-2025-6395 Description: During the TLS 1.3 handshake, a NULL pointer may be dereferenced, leading to a denial of service. Remediation: Upgrade to GnuTLS 3.8.10 or later. CVE-2025-32990 Description: Calling the program may write beyond memory boundaries, leading to a heap overflow. Remediation: Upgrade to GnuTLS 3.8.10 or later. CVE-2025-32988 Description: When exporting a certificate with a different name, memory may be double-freed, leading to memory corruption. Remediation: Upgrade to GnuTLS 3.8.10 or later.

Goal Reached Thanks to every supporter — we hit 100%!

GnuTLS Multiple Vulnerabilities Advisory: Certificate Validation Bypass, Heap Overflow, CVE-2025/2026