[https://gnutls.org/security-new.html does not yet seem to be updated with information on GNUTLS-SA-2026-02-09-1 & GNUTLS-SA-2026-02-09-2.]

-------- Forwarded Message -------- Subject: gnutls 3.8.12 Date: Mon, 9 Feb 2026 10:25:10 -0600 From: Alexander Sosedkin <asosedkin () redhat com> To: gnutls-help () lists gnutls org CC: info-gnu () gnu org

Hello,

We have just released gnutls-3.8.12. This is a bug fix, security and enhancement release on the 3.8.x branch.

We would like to thank everyone who contributed in this release: Alexander Sosedkin, Daiki Ueno, Mikhail Dmitrichenko, František Krenželok, Jan Palus, Julien Olivain, Markus Theil, Maxim Cournoyer, xinpeng wang.

The detailed list of changes follows:

Version 3.8.12 (released 2026-02-09)

libgnutls: Fix NULL pointer dereference in PSK binder verification A TLS 1.3 resumption attempt with an invalid PSK binder value in ClientHello could lead to a denial of service attack via crashing the server. The updated code guards against the problematic dereference. Reported by Jaehun Lee. [Fixes: GNUTLS-SA-2026-02-09-1, CVSS: high] [CVE-2026-1584]

libgnutls: Fix name constraint processing performance issue Verifying certificates with pathological amounts of name constraints could lead to a denial of service attack via resource exhaustion. Reworked processing algorithms exhibit better performance characteristics. Reported by Tim Scheckenbach. [Fixes: GNUTLS-SA-2026-02-09-2, CVSS: medium] [CVE-2025-14831]

libgnutls: Fix multiple unexploitable overflows Reported by Tim Rühsen (#1783, #1786).

libgnutls: Fall back to thread-unsafe module initialization Improve fallback handling for PKCS#11 modules that don't support thread-safe initialization (#1774). Also return filename from p11kitmodulegetname() for unconfigured modules.

libgnutls: Accept NULL as digest argument for gnutlshashoutput The accelerated implementation of gnutlshashoutput() now properly accepts NULL as the digest argument, matching the behavior of the reference implementation (#1769).

srptool: Avoid a stack buffer overflow when processing large SRP groups. Reported and fixed by Mikhail Dmitrichenko (#1777).

API and ABI modifications: No changes since last version.

Getting the Software ================

GnuTLS may be downloaded directly from https://www.gnupg.org/ftp/gcrypt/ A list of GnuTLS mirrors can be found at http://www.gnutls.org/download.html

Here are the XZ compressed sources: https://www.gnupg.org/ftp/gcrypt/gnutls/v3.8/gnutls-3.8.12.tar.xz

Here are OpenPGP detached signatures signed using keys: 5D46CB0F763405A7053556F47A75A648B3F9220C and E987AB7F7E89667776D05B3BB0E9DD20B29F1432 https://www.gnupg.org/ftp/gcrypt/gnutls/v3.8/gnutls-3.8.12.tar.xz.sig

Note that it has been signed with the following openpgp keys:

pub ed25519 2021-12-23 [SC] [expires: 2027-01-01] 5D46CB0F763405A7053556F47A75A648B3F9220C uid [ultimate] Zoltan Fridrich <zfridric () redhat com> sub cv25519 2021-12-23 [E] [expires: 2027-01-01]

pub rsa4096 2016-09-27 [SC] E987AB7F7E89667776D05B3BB0E9DD20B29F1432 uid [ultimate] Alexander Sosedkin <monk () unboiled info> sub rsa4096 2021-08-21 [A] sub rsa4096 2016-09-27 [E] sub rsa4096 2016-09-27 [S]

Regards, Alexander Sosedkin

A flaw was found in gnutls. A use after free issue in clientsendparams in lib/ext/presharedkey.c may lead to memory corruption and other potential consequences.

A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during verification of pkcs7 signatures in gnutlspkcs7verify function.

A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to recover the key encrypted in the RSA ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption the attacker would need to send a large amount of specially crafted messages to the vulnerable server. By recovering the secret from the ClientKeyExchange message, the attacker would be able to decrypt the application data exchanged over that connection.

The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.

Modgnutls is a TLS module for Apache HTTPD based on GnuTLS. Versions from 0.9.0 to 0.12.0 (including) did not properly fail blocking read operations on TLS connections when the transport hit timeouts. Instead it entered an endless loop retrying the read operation, consuming CPU resources. This could be exploited for denial of service attacks. If trace level logging was enabled, it would also produce an excessive amount of log output during the loop, consuming disk space. The problem has been fixed in commit d7eec4e598158ab6a98bf505354e84352f9715ec, please update to version 0.12.1. There are no workarounds, users who cannot update should apply the errno fix detailed in the security advisory.

A flaw was found in gnutls. A use after free issue in client sending keyshare extension may lead to memory corruption and other consequences.

It was found an issue in certificate validation using OCSP responses caused by not verifying the serial length, which can falsely report a certificate as valid.

Upstream patch:

https://gitlab.com/gnutls/gnutls/commit/964632f37dfdfb914ebc5e49db4fa29af35b1de9

External References:

https://www.gnutls.org/security.html https://lists.gnupg.org/pipermail/gnutls-devel/2016-September/008146.html

Buffer overflow in the danequerytlsa function in the DANE library (libdane) in GnuTLS 3.1.x before 3.1.15 and 3.2.x before 3.2.5 allows remote servers to cause a denial of service (memory corruption) via a response with more than four DANE entries.

The gnutlsx509verifycertificate function in lib/x509/verify.c in libgnutls in GnuTLS before 2.6.1 trusts certificate chains in which the last certificate is an arbitrary trusted, self-signed certificate, which allows man-in-the-middle attackers to insert a spoofed certificate for any Distinguished Name (DN).

Use-after-free vulnerability in the gnutlshandshakehashbuffersclear function in lib/gnutlshandshake.c in libgnutls in GnuTLS 2.3.5 through 2.4.0 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via TLS transmission of data that is improperly used when the peer calls gnutlshandshake within a normal session, leading to attempted access to a deallocated libgcrypt handle.

The gnutlsrecvclientkxmessage function in lib/gnutlskx.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 continues to process Client Hello messages within a TLS message after one has already been processed, which allows remote attackers to cause a denial of service (NULL dereference and crash) via a TLS message containing multiple Client Hello messages, aka GNUTLS-SA-2008-1-2.

The gnutlsservernamerecvparams function in lib/extservername.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 does not properly calculate the number of Server Names in a TLS 1.0 Client Hello message during extension handling, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a zero value for the length of Server Names, which leads to a buffer overflow in session resumption data in the packsecurityparameters function, aka GNUTLS-SA-2008-1-1.

Integer signedness error in the gnutlsciphertext2compressed function in lib/gnutlscipher.c in libgnutls in GnuTLS before 2.2.4 allows remote attackers to cause a denial of service (buffer over-read and crash) via a certain integer value in the Random field in an encrypted Client Hello message within a TLS record with an invalid Record Length, which leads to an invalid cipher padding length, aka GNUTLS-SA-2008-1-3.

It was reported that under certain conditions modgnutls ignores "GnuTLSClientVerify require" when specified in directory [1] and server [2] context. Suggested commit that fixes [2] is: https://github.com/airtower-luna/modgnutls/commit/5a8a32bbfb8a83fe6358c5c31c443325a7775fc2 Patch for [1] is attaced in the corresponding bugreport.

[1]: http://issues.outoforder.cc/view.php?id=93 [2]: https://bugs.debian.org/578663

libgnutls in GnuTLS before 2.8.2 does not properly handle a '\0' character in a domain name in the subject's (1) Common Name (CN) or (2) Subject Alternative Name (SAN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.

Mutt 1.5.19, when linked against (1) OpenSSL (muttssl.c) or (2) GnuTLS (muttsslgnutls.c), allows connections when only one TLS certificate in the chain is accepted instead of verifying the entire chain, which allows remote attackers to spoof trusted servers via a man-in-the-middle attack.

gnutls-cli in GnuTLS before 2.6.6 does not verify the activation and expiration times of X.509 certificates, which allows remote attackers to successfully present a certificate that is (1) not yet valid or (2) no longer valid, related to lack of time checks in the gnutlsx509verifycertificate function in lib/x509/verify.c in libgnutlsx509, as used by (a) Exim, (b) OpenLDAP, and (c) libsoup.

lib/gnutlspk.c in libgnutls in GnuTLS 2.5.0 through 2.6.5 generates RSA keys stored in DSA structures, instead of the intended DSA keys, which might allow remote attackers to spoof signatures on certificates or have unspecified other impact by leveraging an invalid DSA key.

lib/pk-libgcrypt.c in libgnutls in GnuTLS before 2.6.6 does not properly handle invalid DSA signatures, which allows remote attackers to cause a denial of service (application crash) and possibly have unspecified other impact via a malformed DSA key that triggers a (1) free of an uninitialized pointer or (2) double free.

A flaw was reported [1] in the GnuTLS gnutlssessiongetdata() function, which could overflow a too-short buffer parameter allocated by the caller. The test which was to avoid such buffer overflows was not working. A malicious server could use this flaw in a vulnerable client to send a larger SessionTicket in the hope of overflowing the client.

Upstream has indicated that they are unaware of any client software that does not properly use the session resumption functions; clients that perform session resumption as documented [2] are not vulnerable.

[1] http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5596 [2] http://www.gnu.org/s/gnutls/manual/htmlnode/Client-with-Resume-capability-example.html#Client-with-Resume-capability-example

The DTLS implementation in GnuTLS 3.0.10 and earlier executes certain error-handling code only if there is a specific relationship between a padding length and the ciphertext size, which makes it easier for remote attackers to recover partial plaintext via a timing side-channel attack, a related issue to CVE-2011-4108.

The gnutlsciphertext2compressed function in lib/gnutlscipher.c in GnuTLS 2.12.23 allows remote attackers to cause a denial of service (buffer over-read and crash) via a crafted padding length. NOTE: this might be due to an incorrect fix for CVE-2013-0169.

IssueDescription:

An out-of-bounds memory write flaw was found in the way GnuTLS parsed certain ECC (Elliptic Curve Cryptography) certificates or certificate signing requests (CSR). A malicious user could create a specially crafted ECC certificate or a certificate signing request that, when processed by an application compiled against GnuTLS (for example, certtool), could cause that application to crash or execute arbitrary code with the permissions of the user running the application.

GnuTLS before 2.9.10 does not verify the activation and expiration dates of CA certificates, which allows man-in-the-middle attackers to spoof servers via a certificate issued by a CA certificate that is (1) not yet valid or (2) no longer valid.

A use-after-free flaw was found in GnuTLS's gnutlsx509dntostring() function. A remote attacker could create a specially crafted certificate with very long DistinguishedName (DN) entries that, when processed by an application compiled against GnuTLS, could cause that application to crash.

This issue was fixed in upstream versions 3.4.4 and 3.3.17 of GnuTLS:

https://lists.gnupg.org/pipermail/gnutls-devel/2015-August/007707.html https://lists.gnupg.org/pipermail/gnutls-devel/2015-August/007708.html

The following patch fixes this issue:

https://gitlab.com/gnutls/gnutls/commit/272854367efc130fbd4f1a51840d80c630214e12

The affected function, gnutlsx509dntostring(), was first introduced in version 3.1.10 via commit:

https://gitlab.com/gnutls/gnutls/commit/6be35136333b5d6289f23209cf896e741462909a

The gnutls packages in Red Hat Enterprise Linux 6 and earlier include GnuTLS versions 2.x or 1.x and are therefore not affected by this issue.

External References:

http://www.gnutls.org/security.html#GNUTLS-SA-2015-3

Double free vulnerability in lib/x509/x509ext.c in GnuTLS before 3.3.14 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted CRL distribution point.

The authentication hook (mgshookauthz) in mod-gnutls 0.5.10 and earlier does not validate client certificates when "GnuTLSClientVerify require" is set, which allows remote attackers to spoof clients via a crafted certificate.

GnuTLS before 3.1.0 does not verify that the RSA PKCS #1 signature algorithm matches the signature algorithm in the certificate, which allows remote attackers to conduct downgrade attacks via unspecified vectors.

GnuTLS before 3.3.13 does not validate that the signature algorithms match when importing a certificate.