Critical Security Advisory: gnutls Package Vulnerability and Update
Summary
RHSA-2026:34372: Red Hat Security Advisory: gnutls security update. Affects gnutls versions < 0:3.3.29-9.el7_9.1. Fixed in 0:3.3.29-9.el7_9.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The gnutls package is a widely used implementation of the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols. It provides cryptographic functions and is essential for secure communications over networks. The gnutls-c++, gnutls-dane, gnutls-devel, and gnutls-utils packages are related components that enhance the functionality of gnutls, making it a critical part of many applications. Due to its extensive use, vulnerabilities in gnutls can have significant implications for security.
Vulnerability Detail
The gnutls package has been identified with multiple vulnerabilities, including CVE-2026-33845, CVE-2026-33846, and CVE-2026-42009. These vulnerabilities can lead to potential security breaches, allowing unauthorized access or data manipulation. The vulnerabilities stem from flaws in the implementation of cryptographic protocols, which could be exploited by attackers to compromise the integrity and confidentiality of data transmitted over secure channels.
How To Fix
Minimum fixed version
0:3.3.29-9.el7_9.1
This is the first release that contains the fix.
sudo dnf update gnutlsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider restricting access to services that rely on gnutls until the update can be applied. Additionally, monitor network traffic for any suspicious activity that may indicate exploitation attempts.
Conclusion
The gnutls package has critical vulnerabilities that require immediate attention. Updating to the patched version is essential to maintain the security of applications relying on this package. Users are encouraged to utilize tools like Vulert for ongoing monitoring and vulnerability management.
See every vulnerability recorded for gnutls →
FAQ
The CVSS score of the vulnerabilities is 7.5, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerabilities could allow attackers to intercept or manipulate secure communications, leading to data breaches or unauthorized access.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If you cannot update immediately, consider implementing access restrictions and monitoring for unusual activity until the update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for gnutls.
