[https://gnutls.org/security-new.html does not yet seem to be updated with information on GNUTLS-SA-2026-02-09-1 & GNUTLS-SA-2026-02-09-2.]

-------- Forwarded Message -------- Subject: gnutls 3.8.12 Date: Mon, 9 Feb 2026 10:25:10 -0600 From: Alexander Sosedkin <asosedkin () redhat com> To: gnutls-help () lists gnutls org CC: info-gnu () gnu org

Hello,

We have just released gnutls-3.8.12. This is a bug fix, security and enhancement release on the 3.8.x branch.

We would like to thank everyone who contributed in this release: Alexander Sosedkin, Daiki Ueno, Mikhail Dmitrichenko, František Krenželok, Jan Palus, Julien Olivain, Markus Theil, Maxim Cournoyer, xinpeng wang.

The detailed list of changes follows:

Version 3.8.12 (released 2026-02-09)

libgnutls: Fix NULL pointer dereference in PSK binder verification A TLS 1.3 resumption attempt with an invalid PSK binder value in ClientHello could lead to a denial of service attack via crashing the server. The updated code guards against the problematic dereference. Reported by Jaehun Lee. [Fixes: GNUTLS-SA-2026-02-09-1, CVSS: high] [CVE-2026-1584]

libgnutls: Fix name constraint processing performance issue Verifying certificates with pathological amounts of name constraints could lead to a denial of service attack via resource exhaustion. Reworked processing algorithms exhibit better performance characteristics. Reported by Tim Scheckenbach. [Fixes: GNUTLS-SA-2026-02-09-2, CVSS: medium] [CVE-2025-14831]

libgnutls: Fix multiple unexploitable overflows Reported by Tim Rühsen (#1783, #1786).

libgnutls: Fall back to thread-unsafe module initialization Improve fallback handling for PKCS#11 modules that don't support thread-safe initialization (#1774). Also return filename from p11kitmodulegetname() for unconfigured modules.

libgnutls: Accept NULL as digest argument for gnutlshashoutput The accelerated implementation of gnutlshashoutput() now properly accepts NULL as the digest argument, matching the behavior of the reference implementation (#1769).

srptool: Avoid a stack buffer overflow when processing large SRP groups. Reported and fixed by Mikhail Dmitrichenko (#1777).

API and ABI modifications: No changes since last version.

Getting the Software ================

GnuTLS may be downloaded directly from https://www.gnupg.org/ftp/gcrypt/ A list of GnuTLS mirrors can be found at http://www.gnutls.org/download.html

Here are the XZ compressed sources: https://www.gnupg.org/ftp/gcrypt/gnutls/v3.8/gnutls-3.8.12.tar.xz

Here are OpenPGP detached signatures signed using keys: 5D46CB0F763405A7053556F47A75A648B3F9220C and E987AB7F7E89667776D05B3BB0E9DD20B29F1432 https://www.gnupg.org/ftp/gcrypt/gnutls/v3.8/gnutls-3.8.12.tar.xz.sig

Note that it has been signed with the following openpgp keys:

pub ed25519 2021-12-23 [SC] [expires: 2027-01-01] 5D46CB0F763405A7053556F47A75A648B3F9220C uid [ultimate] Zoltan Fridrich <zfridric () redhat com> sub cv25519 2021-12-23 [E] [expires: 2027-01-01]

pub rsa4096 2016-09-27 [SC] E987AB7F7E89667776D05B3BB0E9DD20B29F1432 uid [ultimate] Alexander Sosedkin <monk () unboiled info> sub rsa4096 2021-08-21 [A] sub rsa4096 2016-09-27 [E] sub rsa4096 2016-09-27 [S]

Regards, Alexander Sosedkin

A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to recover the key encrypted in the RSA ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption the attacker would need to send a large amount of specially crafted messages to the vulnerable server. By recovering the secret from the ClientKeyExchange message, the attacker would be able to decrypt the application data exchanged over that connection.

A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during verification of pkcs7 signatures in gnutlspkcs7verify function.

A flaw was found in gnutls. A use after free issue in client sending keyshare extension may lead to memory corruption and other consequences.

A flaw was found in gnutls. A use after free issue in clientsendparams in lib/ext/presharedkey.c may lead to memory corruption and other potential consequences.

An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a norenegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the gnutlsdeinit function is called after detecting a handshake failure.

GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application.

GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is 3.6.3 (2018-07-16) because of an error in a 2017-10-06 commit. The DTLS client always uses 32 '\0' bytes instead of a random value, and thus contributes no randomness to a DTLS negotiation. This breaks the security guarantees of the DTLS protocol.

Modgnutls is a TLS module for Apache HTTPD based on GnuTLS. Versions from 0.9.0 to 0.12.0 (including) did not properly fail blocking read operations on TLS connections when the transport hit timeouts. Instead it entered an endless loop retrying the read operation, consuming CPU resources. This could be exploited for denial of service attacks. If trace level logging was enabled, it would also produce an excessive amount of log output during the loop, consuming disk space. The problem has been fixed in commit d7eec4e598158ab6a98bf505354e84352f9715ec, please update to version 0.12.1. There are no workarounds, users who cannot update should apply the errno fix detailed in the security advisory.

A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles verification of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run process on the same physical core as the victim process, could use this to extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.

It was found an issue in certificate validation using OCSP responses caused by not verifying the serial length, which can falsely report a certificate as valid.

Upstream patch:

https://gitlab.com/gnutls/gnutls/commit/964632f37dfdfb914ebc5e49db4fa29af35b1de9

External References:

https://www.gnutls.org/security.html https://lists.gnupg.org/pipermail/gnutls-devel/2016-September/008146.html

It was reported that gnutls 3.4.12 uses an environment variable (GNUTLSKEYLOGFILE) to write the keys of the running sessions. This variable is obtained insecurely via getenv(), meaning that any set-uid program using gnutls can be used to overwrite any file on the filesystem.

Upstream patch:

https://gitlab.com/gnutls/gnutls/compare/fb2a6baef79f4aadfd95e657fe5a18da20a1410e...86076c9b17b9a32b348cafb8b724f57f7da64d58

External References:

http://gnutls.org/security.html#GNUTLS-SA-2016-1

Double free vulnerability in lib/x509/x509ext.c in GnuTLS before 3.3.14 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted CRL distribution point.

GnuTLS before 2.9.10 does not verify the activation and expiration dates of CA certificates, which allows man-in-the-middle attackers to spoof servers via a certificate issued by a CA certificate that is (1) not yet valid or (2) no longer valid.

A use-after-free flaw was found in GnuTLS's gnutlsx509dntostring() function. A remote attacker could create a specially crafted certificate with very long DistinguishedName (DN) entries that, when processed by an application compiled against GnuTLS, could cause that application to crash.

This issue was fixed in upstream versions 3.4.4 and 3.3.17 of GnuTLS:

https://lists.gnupg.org/pipermail/gnutls-devel/2015-August/007707.html https://lists.gnupg.org/pipermail/gnutls-devel/2015-August/007708.html

The following patch fixes this issue:

https://gitlab.com/gnutls/gnutls/commit/272854367efc130fbd4f1a51840d80c630214e12

The affected function, gnutlsx509dntostring(), was first introduced in version 3.1.10 via commit:

https://gitlab.com/gnutls/gnutls/commit/6be35136333b5d6289f23209cf896e741462909a

The gnutls packages in Red Hat Enterprise Linux 6 and earlier include GnuTLS versions 2.x or 1.x and are therefore not affected by this issue.

External References:

http://www.gnutls.org/security.html#GNUTLS-SA-2015-3

GnuTLS before 3.1.0 does not verify that the RSA PKCS #1 signature algorithm matches the signature algorithm in the certificate, which allows remote attackers to conduct downgrade attacks via unspecified vectors.

The authentication hook (mgshookauthz) in mod-gnutls 0.5.10 and earlier does not validate client certificates when "GnuTLSClientVerify require" is set, which allows remote attackers to spoof clients via a crafted certificate.

It was reported that under certain conditions modgnutls ignores "GnuTLSClientVerify require" when specified in directory [1] and server [2] context. Suggested commit that fixes [2] is: https://github.com/airtower-luna/modgnutls/commit/5a8a32bbfb8a83fe6358c5c31c443325a7775fc2 Patch for [1] is attaced in the corresponding bugreport.

[1]: http://issues.outoforder.cc/view.php?id=93 [2]: https://bugs.debian.org/578663

GnuTLS before 3.3.13 does not validate that the signature algorithms match when importing a certificate.

IssueDescription:

An out-of-bounds memory write flaw was found in the way GnuTLS parsed certain ECC (Elliptic Curve Cryptography) certificates or certificate signing requests (CSR). A malicious user could create a specially crafted ECC certificate or a certificate signing request that, when processed by an application compiled against GnuTLS (for example, certtool), could cause that application to crash or execute arbitrary code with the permissions of the user running the application.

Buffer overflow in the danequerytlsa function in the DANE library (libdane) in GnuTLS 3.1.x before 3.1.15 and 3.2.x before 3.2.5 allows remote servers to cause a denial of service (memory corruption) via a response with more than four DANE entries.

The gnutlsciphertext2compressed function in lib/gnutlscipher.c in GnuTLS 2.12.23 allows remote attackers to cause a denial of service (buffer over-read and crash) via a crafted padding length. NOTE: this might be due to an incorrect fix for CVE-2013-0169.

The DTLS implementation in GnuTLS 3.0.10 and earlier executes certain error-handling code only if there is a specific relationship between a padding length and the ciphertext size, which makes it easier for remote attackers to recover partial plaintext via a timing side-channel attack, a related issue to CVE-2011-4108.

A flaw was reported [1] in the GnuTLS gnutlssessiongetdata() function, which could overflow a too-short buffer parameter allocated by the caller. The test which was to avoid such buffer overflows was not working. A malicious server could use this flaw in a vulnerable client to send a larger SessionTicket in the hope of overflowing the client.

Upstream has indicated that they are unaware of any client software that does not properly use the session resumption functions; clients that perform session resumption as documented [2] are not vulnerable.

[1] http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5596 [2] http://www.gnu.org/s/gnutls/manual/htmlnode/Client-with-Resume-capability-example.html#Client-with-Resume-capability-example

libgnutls in GnuTLS before 2.8.2 does not properly handle a '\0' character in a domain name in the subject's (1) Common Name (CN) or (2) Subject Alternative Name (SAN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.

The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.

Mutt 1.5.19, when linked against (1) OpenSSL (muttssl.c) or (2) GnuTLS (muttsslgnutls.c), allows connections when only one TLS certificate in the chain is accepted instead of verifying the entire chain, which allows remote attackers to spoof trusted servers via a man-in-the-middle attack.

gnutls-cli in GnuTLS before 2.6.6 does not verify the activation and expiration times of X.509 certificates, which allows remote attackers to successfully present a certificate that is (1) not yet valid or (2) no longer valid, related to lack of time checks in the gnutlsx509verifycertificate function in lib/x509/verify.c in libgnutlsx509, as used by (a) Exim, (b) OpenLDAP, and (c) libsoup.

lib/gnutlspk.c in libgnutls in GnuTLS 2.5.0 through 2.6.5 generates RSA keys stored in DSA structures, instead of the intended DSA keys, which might allow remote attackers to spoof signatures on certificates or have unspecified other impact by leveraging an invalid DSA key.

lib/pk-libgcrypt.c in libgnutls in GnuTLS before 2.6.6 does not properly handle invalid DSA signatures, which allows remote attackers to cause a denial of service (application crash) and possibly have unspecified other impact via a malformed DSA key that triggers a (1) free of an uninitialized pointer or (2) double free.