Description
A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform Resource Identifier (URI) or Service (SRV) Subject Alternative Names (SANs). This could cause the certificate validation process to incorrectly fall back to checking DNS hostnames against the Common Name (CN), potentially allowing the attacker to spoof legitimate services or intercept sensitive information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | gnutls | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION | — | — |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.20 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.21 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.22 | — | — |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.17 | — | — |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.18 | — | — |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.20 | — | — |
| Red Hat | Red Hat Discovery 2 | — | — |
| Red Hat | Red Hat Hardened Images | — | — |
| Red Hat | Red Hat OpenShift AI 3.4 | — | — |
| Red Hat | Red Hat Update Infrastructure 5 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 5 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gnutls28 | 3.8.13-1 | — |
| Debian 13 | gnutls28 | 3.8.9-3+deb13u4 | — |
| Debian 12 | gnutls28 | 3.7.9-2+deb12u7 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | gnutls28 | 3.8.12-2ubuntu1.1 | — |
| Ubuntu 25.10 | gnutls28 | 3.8.9-3ubuntu2.2 | — |
| Ubuntu 24.04 LTS | gnutls28 | 3.8.3-1.1ubuntu3.6 | — |
| Ubuntu 22.04 LTS | gnutls28 | 3.7.3-4ubuntu1.9 | — |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro FIPS-updates 24.04 LTS | gnutls28 | 3.8.3-1.1ubuntu3.6+Fips1.2 | — |
| Ubuntu Pro FIPS-updates 22.04 LTS | gnutls28 | 3.7.3-4ubuntu1.9+Fips1 | — |
| Ubuntu Pro FIPS-preview 22.04 LTS | gnutls28 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | gnutls28 | 3.6.13-2ubuntu1.12+esm3 | USN-8539-1 |
| Ubuntu Pro 18.04 LTS | gnutls28 | 3.5.18-1ubuntu1.6+esm4 | USN-8539-1 |
| Ubuntu Pro 16.04 LTS | gnutls28 | 3.4.10-4ubuntu1.9+esm4 | USN-8539-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | gnutls +5 | 3.8.10-4.el10_2 | RHSA-2026:20613 |
| RHEL 9 | gnutls +4 | 3.8.10-4.el9_8 | RHSA-2026:20612 |
| RHEL 8 | gnutls +4 | 3.6.16-8.el8_10.6 | RHSA-2026:20611 |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | gnutls +5 | 3.8.9-9.el10_0.19 | RHSA-2026:26409 |
| RHEL 9.6 EUS | gnutls +4 | 3.8.3-6.el9_6.4 | RHSA-2026:30004 |
| RHEL 9.4 E4S | gnutls +4 | 3.8.3-4.el9_4.6 | RHSA-2026:32962 |
| RHEL 9.2 E4S | gnutls +4 | 3.7.6-21.el9_2.7 | RHSA-2026:41921 |
| RHEL 8.8 TUS | gnutls +4 | 3.6.16-7.el8_8.4 | RHSA-2026:30850 |
| RHEL 8.8 TUS | libtasn1 +2 | 4.13-4.el8_8.1 | RHSA-2026:30850 |
| RHEL 8.8 E4S | gnutls +4 | 3.6.16-7.el8_8.4 | RHSA-2026:30850 |
| RHEL 8.8 E4S | libtasn1 +2 | 4.13-4.el8_8.1 | RHSA-2026:30850 |
| RHEL 8.6 EUS Long Life | gnutls +4 | 3.6.16-5.el8_6.5 | RHSA-2026:30849 |
| RHEL 8.6 EUS Long Life | libtasn1 +2 | 4.13-3.el8_6.2 | RHSA-2026:30849 |
| RHEL 8.6 AUS | gnutls +4 | 3.6.16-5.el8_6.5 | RHSA-2026:30849 |
| RHEL 8.6 AUS | libtasn1 +2 | 4.13-3.el8_6.2 | RHSA-2026:30849 |
| RHEL 8.4 EUS Long Life | gnutls +4 | 3.6.14-10.el8_4.1 | RHSA-2026:33125 |
| RHEL 8.4 EUS Long Life | libtasn1 +2 | 4.13-3.el8_4.1 | RHSA-2026:33125 |
| RHEL 8.4 AUS | gnutls +4 | 3.6.14-10.el8_4.1 | RHSA-2026:33125 |
| RHEL 8.4 AUS | libtasn1 +2 | 4.13-3.el8_4.1 | RHSA-2026:33125 |
| RHEL 7 ELS | gnutls +4 | 3.3.29-9.el7_9.2 | RHSA-2026:43575 |
| Red Hat Hardened Images 1 | gnutls +7 | 3.8.13-1.hum1 | RHSA-2026:13274 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | gnutls +5 | 3.8.10-4.el10_2 | ALSA-2026:20613 |
| AlmaLinux 9 | gnutls +4 | 3.8.10-4.el9_8 | ALSA-2026:20612 |
| AlmaLinux 8 | gnutls +4 | 3.6.16-8.el8_10.6 | ALSA-2026:20611 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | gnutls | 3.8.10-4.el10_2 | RLSA-2026:20613 |
| Rocky Linux 9 | gnutls | 3.8.10-4.el9_8 | RLSA-2026:20612 |
| Rocky Linux 8 | gnutls | 3.6.16-8.el8_10.6 | RLSA-2026:20611 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 5.3 | gnutls | 3.7.3-150400.24.2 | SUSE-SU-2026:2822-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | gnutls | 3.8.13-1.1 | openSUSE-SU-2026:10691-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | gnutls | 3.8.13-r0 | — |
| Alpine v3.23 | gnutls | 3.8.13-r0 | — |
| Alpine v3.22 | gnutls | 3.8.13-r0 | — |
| Alpine v3.21 | gnutls | 3.8.13-r0 | — |
| Alpine v3.20 | gnutls | 3.8.13-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | gnutls +4 | 3.8.10-4.amzn2023.0.2 | ALAS2023-2026-1808 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | gnutls | 3.8.13-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | gnutls +5 | 3.8.10-4.el10_2 | ELSA-2026-20613 |
| Oracle Linux 9 | gnutls +4 | 3.8.10-4.el9_8 | ELSA-2026-50346, ELSA-2026-20612 |
| Oracle Linux 8 | gnutls +4 | 3.6.16-8.el8_10.6 | ELSA-2026-20611 |
| Oracle Linux 7 | gnutls +4 | 3.3.29-9.0.3.el7_9 | ELSA-2026-43575 |
Advisories 32
- WID-SEC-2026-1312 GnuTLS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- ALSA-2026:20613 Important: gnutls security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:20612 Important: gnutls security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:20611 Important: gnutls security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-3623 IBM DataPower Gateway: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 18, 2026
- RHSA-2026:41921 Red Hat Security Advisory: gnutls security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:33125 Red Hat Security Advisory: gnutls and libtasn1 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:32962 Red Hat Security Advisory: gnutls security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:30850 Red Hat Security Advisory: gnutls and libtasn1 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:30849 Red Hat Security Advisory: gnutls and libtasn1 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:30004 Red Hat Security Advisory: gnutls security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:26409 Red Hat Security Advisory: gnutls security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:20613 Red Hat Security Advisory: gnutls security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:20611 Red Hat Security Advisory: gnutls security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:20612 Red Hat Security Advisory: gnutls security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:13274 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- NCSC-2026-0431 Kwetsbaarheden verholpen in IBM DataPower Gateway en onderliggende componenten NCSC-NL (Netherlands) · Oct 16, 2026
- RHSA-2026:43575 Red Hat Security Advisory: gnutls security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- WID-SEC-2026-3043 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 17, 2026
- VDE-2026-088 METTLER TOLEDO: LabX Standard and Enterprise Report on External Component Analysis - v21.4 CERT@VDE · Sep 10, 2026
- ELSA-2026-43575 Moderate: gnutls security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 11, 2026
- ELSA-2026-20613 Important: gnutls security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 17, 2026
- USN-8539-1 gnutls28 vulnerabilities Ubuntu Security Notices (USN) · Jul 14, 2026
- SUSE-SU-2026:2822-1 Security update for gnutls SUSE / openSUSE Security Updates · Jul 10, 2026
- ELSA-2026-50346 Important: gnutls security fix update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 24, 2026
- ELSA-2026-20612 Important: gnutls security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 24, 2026
- ALAS2023-2026-1808 Moderate: gnutls security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 8, 2026
- RLSA-2026:20613 Important: gnutls security update Rocky Linux Security Advisories · Jun 5, 2026
- RLSA-2026:20612 Important: gnutls security update Rocky Linux Security Advisories · Jun 2, 2026
- RLSA-2026:20611 Important: gnutls security update Rocky Linux Security Advisories · May 29, 2026
- ELSA-2026-20611 Important: gnutls security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 27, 2026
- openSUSE-SU-2026:10691-1 gnutls-3.8.13-1.1 on GA media SUSE / openSUSE Security Updates · May 6, 2026
References
- RHSA-2026:13274 vendor-advisory
- RHSA-2026:20611 vendor-advisory
- RHSA-2026:20612 vendor-advisory
- RHSA-2026:20613 vendor-advisory
- RHSA-2026:26319 vendor-advisory
- RHSA-2026:26409 vendor-advisory
- RHSA-2026:29197 vendor-advisory
- RHSA-2026:30004 vendor-advisory
- RHSA-2026:30849 vendor-advisory
- RHSA-2026:30850 vendor-advisory
- RHSA-2026:32962 vendor-advisory
- RHSA-2026:33125 vendor-advisory
- RHSA-2026:41921 vendor-advisory
- RHSA-2026:43575 vendor-advisory
- RHSA-2026:58981 vendor-advisory
- RHSA-2026:72502 vendor-advisory
- RHSA-2026:74674 vendor-advisory
- RHSA-2026:82304 vendor-advisory
- RHSA-2026:82322 vendor-advisory
- RHSA-2026:82347 vendor-advisory
- RHSA-2026:82354 vendor-advisory
- RHSA-2026:82372 vendor-advisory
- RHSA-2026:82857 vendor-advisory
- RHSA-2026:82888 vendor-advisory
- RHSA-2026:89197 vendor-advisory
- RHSA-2026:89232 vendor-advisory
- RHSA-2026:89333 vendor-advisory
- RHSA-2026:94442 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-42012 vdb-entry
- RHBZ#2467441 issue-tracking
- https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-7