A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.
A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in mergehandshakepacket() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the messagelength field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting messagelength values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.
A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service.
A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of nameConstraints labels, specifically for dNSName (DNS) or rfc822Name (email) constraints within excludedSubtrees or permittedSubtrees. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.
gnutls compares nameConstraints labels using a case-sensitive memcmp path without an ascii-casefold canonicalization step. when excludedSubtrees/permittedSubtrees dNSName (dns) or rfc822Name (email) constraints are present, attacker-controlled casing differences in the leaf certificate SAN can cause a false accept (policy bypass) where the certificate should be rejected.
A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online Certificate Status Protocol (OCSP) response during a TLS handshake. Due to a logic error in how gnutls processes multi-record OCSP responses, a client with OCSP verification enabled may incorrectly accept a revoked server certificate, potentially leading to a compromise of trust.
A flaw was found in gnutls. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted ClientHello message with an invalid Pre-Shared Key (PSK) binder value during the TLS handshake. This can lead to a NULL pointer dereference, causing the server to crash and resulting in a remote Denial of Service (DoS) condition.
A flaw was found in the GnuTLS library, specifically in the gnutlspkcs11tokeninit() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.
A NULL pointer dereference flaw was found in the GnuTLS software in gnutlsfigurecommonciphersuite().
A double-free vulnerability exists in GnuTLS (confirmed in version 3.8.9) due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1deletestructure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function or caller later attempts to free the same structure. This vulnerability can be triggered using only public GnuTLS APIs and may result in denial of service or memory corruption, depending on allocator behavior.
A heap-buffer-overread vulnerability exists in GnuTLS (confirmed in version 3.8.9) due to unsafe handling of the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension during X.509 certificate parsing. The vulnerability can be triggered by a malicious peer presenting a crafted certificate containing a malformed SCT extension (OID 1.3.6.1.4.1.11129.2.4.2). This overread may lead to disclosure of heap memory contents to attackers if the SCT logid is logged, exported, or otherwise exposed by the application consuming the GnuTLS client library.
A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).
gnutls matches a stapled ocsp response to the server certificate by scanning SingleResponse records, but then reads certstatus from record index 0 unconditionally. when a multi-record ocsp response is stapled such that record 0 is for a different certificate (good) and the matching record for the server certificate is later (revoked), a client with ocsp verification enabled can accept a revoked server certificate. this is observable as an order-dependent accept/reject outcome for the same revoked server certificate.
Verifying Certificates with large amout of name constraints and subject alternative names makes GnuTLS vulnerable to DoS attacks
When trying to verify a certificate chain using the certtool --verify command, with certificates, that contain a larger number of SANs and Name Constraints, GnuTLS tries to verify all of them, without any bound on the quantity of those fields. Using those crafted malicious certificate, GnuTLS is vulnerable to DoS attacks by excessive usage of CPU and memory.
Stack-based buffer overflow vulnerability in the PKCS#11 token initialization function gnutlspkcs11tokeninit() of the GnuTLS library. The flaw is caused by an unsafe memcpy into a fixed-size stack buffer (flabel[32]) without proper bounds checking. If an attacker provides a token label longer than 32 bytes, it leads to out-of-bounds memory writes, causing a crash or, in some environments, potential code execution. Although the vulnerability requires local access or interaction with a malicious PKCS#11 token, it poses a security risk by enabling denial-of-service or possible privilege escalation in applications relying on GnuTLS.
Summarysummary A malicious TLS client can trigger a NULL pointer dereference on the server by sending a crafted ClientHello message with an invalid PSK binder value. This leads to a server crash and constitutes a remote Denial-of-Service condition.
Technical Detailstechnical-details The issue occurs during PSK binder verification in the server-side code path.
In presharedkey.c, when the server receives a presharedkey extension, the function gnutlspskrecvparams() is invoked. Under certain conditions, the following logic is executed:
pskcred = (gnutlspskservercredentialst) gnutlsgetcred(session, GNUTLSCRDPSK); if (pskcred == NULL && (session->internals.flags & GNUTLSNOTICKETS)) return 0; return serverrecvparams(session, data, len, pskcred); When the server issues a NewSessionTicket and the client later sends a ClientHello using the ticket identity from that message, gnutlsgetcred() returns NULL. However, in this scenario the conditional check above does not return early, and pskcred (which is NULL) is passed to serverrecvparams().
Inside serverrecvparams(), the PSK binder value is verified. If the received binder size matches the PRF MAC length but the binder value itself is incorrect, the following code path is taken:
if (gnutlsmacgetalgolen(prf) != binderrecvd.size || gnutlsmemcmp(bindervalue, binderrecvd.data, binderrecvd.size)) { if (pskcred->binderalgo == NULL && mac == GNUTLSMACSHA384) { mac = GNUTLSMACSHA256; gnutlsfreekeydatum(&key); goto retrybinder; } gnutlsassert(); ret = GNUTLSERECEIVEDILLEGALPARAMETER; goto fail; } At this point, pskcred is NULL, and dereferencing pskcred->binderalgo results in a NULL pointer dereference and crashes the server.
Security Impactsecurity-impact An unauthenticated remote client can reliably crash a gnuTLS-based TLS server by sending a malformed ClientHello with incorrect PSK binder values. This constitutes a remote Denial-of-Service vulnerability.
Proof of Conceptproof-of-concept Due to ongoing research constraints, I am unable to publicly disclose the PoC at this time. However, I can provide a minimal Python-based PoC privately upon request to assist with verification and debugging.
Priority Argument Settingspriority-argument-settings For completeness, the following priority string was used in my test environment: This priority configuration is specific to my research and experimental setup. However, the NULL pointer dereference does not depend on this particular priority string. In a more typical configuration, as long as the server issues a NewSessionTicket and a malicious client subsequently sends a ClientHello that references the ticket identity with an invalid PSK binder, the same NULL pointer dereference condition can still be triggered.
In other words, the issue is inherent to the server-side PSK binder handling logic and is not limited to this experimental priority configuration.
A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to increased resource consumption. This flaw allows a remote attacker to send a specially crafted certificate, causing GnuTLS to become unresponsive or slow, resulting in a denial-of-service condition.
A double-free vulnerability exists in GnuTLS (confirmed in version 3.8.9) due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1deletestructure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function or caller later attempts to free the same structure. This vulnerability can be triggered using only public GnuTLS APIs and may result in denial of service or memory corruption, depending on allocator behavior.
GNUTLS - NULL pointer dereference in gnutlsfigurecommonciphersuite()
A heap-buffer-overread vulnerability exists in GnuTLS (confirmed in version 3.8.9) due to unsafe handling of the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension during X.509 certificate parsing. The vulnerability can be triggered by a malicious peer presenting a crafted certificate containing a malformed SCT extension (OID 1.3.6.1.4.1.11129.2.4.2). This overread may lead to disclosure of heap memory contents to attackers if the SCT logid is logged, exported, or otherwise exposed by the application consuming the GnuTLS client library.
-------- Forwarded Message -------- Subject: gnutls 3.8.13 Date: Wed, 29 Apr 2026 12:36:47 -0500 From: Alexander Sosedkin <asosedkin () redhat com> To: gnutls-help () lists gnutls org CC: info-gnu () gnu org
Hello,
We have just released gnutls-3.8.13. This is a bug fix, security and enhancement release on the 3.8.x branch.
We would like to thank everyone who contributed in this release: Alexander Sosedkin, Daiki Ueno, David Dudas, Ghadi Elie Rahme, Guillaume Gardet, Joachim Vandersmissen, Joshua Rogers, Romain Tartière, Ross Burton, Rudi Heitbaum, Sam James, Zoltán Fridrich.
The detailed list of changes follows:
Version 3.8.13 (released 2026-04-29)
libgnutls: Add more checks to DTLS reassembly Previously, gnutls didn't check that DTLS fragments claimed a consistent messagelength value. Additionally, a crucial array size check was missing, enabling an attacker to cause a heap overwrite. Reject fragments with mismatching length and add a missing boundary check. Independently reported by Haruto Kimura (Stella), Oscar Reparaz and Zou Dikai. [GNUTLS-SA-2026-04-29-1, CVSS: high] [CVE-2026-33846]
libgnutls: Fix qsort comparator in DTLS reassembly The comparator function used for ordering DTLS packets by sequence numbers did not follow qsort comparator contracts in case of packets with duplicate sequence numbers, which could lead to unstable ordering or undefined behaviour. Return 0 in such cases makes the sorting stable. Additionally, discard packets with same sequence numbers and differing handshake type, so that they don't end up being sorted in the first place. Reported by Joshua Rogers of AISLE Research Team. [GNUTLS-SA-2026-04-29-2, CVSS: high] [CVE-2026-42009]
libgnutls: Fix crashing on an underflow with a DTLS datagram A remotely triggerable underflow in the DTLS reassembly code led to a heap overrun. Prevent the underflow from happening. Reported by Joshua Rogers of AISLE Research Team. [GNUTLS-SA-2026-04-29-3, CVSS: high] [CVE-2026-33845]
libgnutls: Fix RSA-PSK identity truncation Servers configured with RSA-PSK have wrongfully matched usernames with NUL character in them to ones truncated to NUL character, which could lead to an authentication bypass. Fix the check to perform comparison up to the full username length. Reported by Joshua Rogers of AISLE Research Team. [GNUTLS-SA-2026-04-29-4, CVSS: high] [CVE-2026-42010]
libgnutls: Fix case-sensitivity of domain name comparison in name constraints Domain name comparison during name constraints processing was case-sensitive, violating RFC 5280 section 7.2. For excluded name constraints, this could lead to incorrectly accepting domain names that should've been rejected. DNS name comparison and the domain part of email names now perform case-insensitive comparison. Independently reported by Oleh Konko (1seal) and Joshua Rogers of AISLE Research Team. [GNUTLS-SA-2026-04-29-5, CVSS: high] [CVE-2026-3833]
libgnutls: Fix intersecting empty constraints Permitted name constraints were wrongfully ignored when prior CAs only had excluded name constraints, resulting in a name constraint bypass. Reported by Haruto Kimura (Stella). [GNUTLS-SA-2026-04-29-6, CVSS: medium] [CVE-2026-42011]
libgnutls: Suppress CN fallback in presence of URI and SRV SAN Certificates containing URI or SRV Subject Alternative Names no longer fall back to checking DNS hostnames against Common Name to avoid potential misuse of such certificates beyond their original purpose. Reported by Oleh Konko (1seal). [GNUTLS-SA-2026-04-27-7, CVSS: medium] [CVE-2026-42012]
libgnutls: Suppress CN fallback for oversized SAN Validation of certificates with oversized Subject Alternative Names no longer falls back to checking DNS hostnames against Common Name. Independently reported by Haruto Kimura (Stella) and Joshua Rogers of AISLE Research Team. [GNUTLS-SA-2026-04-27-8, CVSS: medium] [CVE-2026-42013]
libgnutls: Fix use-after-free in gnutlspkcs11tokensetpin Changing the Security Officer PIN with gnutlspkcs11tokensetpin() with oldpin == NULL for a token lacking a protected authentication path led to a use-after-free. Reported by Luigino Camastra and Joshua Rogers of AISLE Research Team. [GNUTLS-SA-2026-04-29-9, CVSS: medium] [CVE-2026-42014]
libgnutls: Fix overread in RSA key exchange with PKCS#11 keys For a server using an RSA key backed by a PKCS#11 token, a client sending an extremely short premaster secret during an RSA key exchange could trigger a short heap overread. Reported by Joshua Rogers of AISLE Research Team. [GNUTLS-SA-2026-04-29-10, CVSS: medium] [CVE-2026-5260]
libgnutls: Fix off-by-one in PKCS#12 bag element bounds check Appending to a PKCS#12 bag that already contained 32 elements could write past the bag's internal array. Reported by Zou Dikai. [GNUTLS-SA-2026-04-29-11, CVSS: low] [CVE-2026-42015]
libgnutls: Fix multi-entry OCSP response revocation bypass When validating a certificate against a multi-entry OCSP response, the revocation status was always checked for the first entry instead of the entry matching the certificate, which could lead to accepting revoked certificates. Independently reported by Oleh Konko (1seal) and Joshua Rogers of AISLE Research Team. [GNUTLS-SA-2026-04-29-12, CVSS: low] [CVE-2026-3832]
libgnutls: Fix timing side-channel in PKCS#7 padding removal The PKCS#7 padding check performed during decryption was not constant-time, potentially leaking information about the padding bytes through timing differences. Rewritten to remove padding in a branch-free manner. Reported by Doria Tang of Stony Brook University. [GNUTLS-SA-2026-04-29-13, CVSS: low] [CVE-2026-5419]
libgnutls: Fix PSK username comparison during rehandshake Rehandshaking to a username with embedded NUL character could theoretically allow bypassing the GNUTLSALLOWIDCHANGE protection (#1808). Reported and fixed by Joshua Rogers of AISLE Research Team.
libgnutls: Fix OID length check for OCSP delegated signer EKU The OCSP signing EKU OID was compared without verifying its length, allowing a shorter OID that shares the same prefix to match. The check now verifies the length as well (#1810). Reported by Joshua Rogers of AISLE Research Team.
libgnutls: Fix AES keys persisting with pkcs11-provider When using the pkcs11-provider, AES keys used for cipher operations were created as persistent objects and accumulating. They are now ephemeral (#1813).
libgnutls: Fix missing RSA key coprimality check in verifyparams gnutlsprivkeyverifyparams overlooked the scenario of p and q not being co-prime. It now returns GNUTLSEPKINVALIDPRIVKEY in this case (#1818). Reported by Kamil Frankowicz.
libgnutls: Fix overread when parsing OpenSSL PEM private keys Insufficient bounds checking on the PEM header length could lead to short heap overreads on specially crafted inputs (#1854). Independently reported by Kamil Frankowicz and Joshua Rogers of AISLE Research Team.
libgnutls: Fix a theoretical double-free during certificate import If gnutlsx509crtlistimportpkcs11 failed partway through, the trust list cleanup code would try to free already-deinitialized certificate entries, leading to a double-free (#1819). Reported by Joshua Rogers of AISLE Research Team.
libgnutls: Fix heap overread in SCT extension parser The list-length validation didn't account for the 2-byte length field, allowing a specially crafted SCT extension to cause a 2-byte overread past the buffer (#1822). Reported by Joshua Rogers of AISLE Research Team.
libgnutls: Zeroize shared secret derived during hybrid key exchange The derived shared secret was not zeroized before being freed (#1841). Reported by liyue.
build: Support building with Nettle 4.0 Nettle 4.0 was released in Feburary 2026, with API incompatibile changes from 3.10. The library can now compile with it, while Nettle 3.10 is still supported (#1791).
libgnutls: Support deriving ML-DSA public key from an expanded private key RFC 9881 defines 3 private key formats for ML-DSA: "seed", "expandedKey" and both. It is now possible to derive a public key from a private key in the "expandedKey" format (#1723).
libgnutls: Fix loading BIT STRING encoded EdDSA key from PKCS#11 For compatibility reasons, the library supports two formats for EdDSA private keys: either ASN.1 BIT STRING (raw) or OCTET STRING (DER). Previously, loading a private key in the former format resulted in a failure, which is now fixed (#1749).
libgnutls: HPKE (RFC 9180) is now supported as a technology preview The Hybrid Public Key Encryption (HPKE) is a flexible cryptographic protocol which enables to encrypt arbitrary data to a recipient, by combining key encapsulation mechanism (KEM) and authenticated encryption with additional data (AEAD). GnuTLS now includes the implementation contributed by David Dudas. Given this is a technology preview, the implementation and the API might suffer modification in the following period. Use --enable-hpke to turn on this feature (#1506).
libgnutls: Fix TLS 1.3 client certificate selection For servers that send a signaturealgorithms extension in CertificateRequest with new rsapssrsae algorithms and without the legacy rsapkcs1 ones, the client now properly considers RSA when selecting a certificate to send. This fixes TLS 1.3 interoperability with newer Java servers when using client certificates. Contributed by Romain Tartière (#1842).
libgnutls: Fix kTLS ChaCha20-Poly1305 IV for TLS 1.2 When using kTLS with ChaCha20-Poly1305 under TLS 1.2, an incorrect value was passed as the IV to the kernel, causing connections to fail early.
libgnutls: Allow fetching object type metadata for PKCS#11 keys A new library function, gnutlspkcs11objgetpkalgorithm, has been added to check the public key algorithms of PKCS#11 key objects. Object types other than CKOPRIVATEKEY are currently not supported. Contributed by Ghadi Elie Rahme (!2074).
API and ABI modifications: gnutlshpkekemt: New enum gnutlshpkekdft: New enum gnutlshpkeaeadt: New enum gnutlshpkemodet: New enum gnutlshpkerolet: New enum gnutlshpkecontextst: New context structure gnutlshpkeinit: New function gnutlshpkedeinit: New function gnutlshpkeencap: New function gnutlshpkeseal: New function gnutlshpkedecap: New function gnutlshpkeopen: New function gnutlshpkederivekeypair: New function gnutlshpkeexport: New function gnutlspkcs11objgetpkalgorithm: New function
Getting the Software ================
GnuTLS may be downloaded directly from https://www.gnupg.org/ftp/gcrypt/ A list of GnuTLS mirrors can be found at http://www.gnutls.org/download.html
Here are the XZ compressed sources: https://www.gnupg.org/ftp/gcrypt/gnutls/v3.8/gnutls-3.8.13.tar.xz
Here are OpenPGP detached signatures signed using keys: 5D46CB0F763405A7053556F47A75A648B3F9220C and E987AB7F7E89667776D05B3BB0E9DD20B29F1432 https://www.gnupg.org/ftp/gcrypt/gnutls/v3.8/gnutls-3.8.13.tar.xz.sig
Note that it has been signed with the following openpgp keys:
pub ed25519 2021-12-23 [SC] [expires: 2027-01-01] 5D46CB0F763405A7053556F47A75A648B3F9220C uid [ultimate] Zoltan Fridrich <zfridric () redhat com> sub cv25519 2021-12-23 [E] [expires: 2027-01-01]
pub rsa4096 2016-09-27 [SC] E987AB7F7E89667776D05B3BB0E9DD20B29F1432 uid [ultimate] Alexander Sosedkin <monk () unboiled info> sub rsa4096 2016-09-27 [E] sub rsa4096 2016-09-27 [S]
Regards, Alexander Sosedkin