Critical Security Vulnerability in gnutls Package: Red Hat Security Advisory
Summary
RHSA-2026:26409: Red Hat Security Advisory: gnutls security update. Affects gnutls versions < 0:3.8.9-9.el10_0.19. Fixed in 0:3.8.9-9.el10_0.19. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The gnutls package is a widely-used implementation of the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols. It provides cryptographic functions and is essential for secure communications over networks. This package is integral to many applications that require secure data transmission. However, recent vulnerabilities have been identified that could compromise its security, necessitating immediate attention from users and administrators.
Vulnerability Detail
The vulnerabilities identified in the gnutls package include multiple CVEs (CVE-2026-3832, CVE-2026-3833, CVE-2026-5260, CVE-2026-5419, CVE-2026-33845, CVE-2026-33846, CVE-2026-42009, CVE-2026-42010, CVE-2026-42011, CVE-2026-42012, CVE-2026-42013, CVE-2026-42014, CVE-2026-42015) that could lead to unauthorized access, data leakage, or denial of service. The vulnerabilities stem from flaws in the implementation of cryptographic protocols, which could allow attackers to exploit these weaknesses to gain sensitive information or disrupt services. The CVSS score for this vulnerability is 8.2, indicating a high severity level that requires prompt remediation.
How To Fix
Minimum fixed version
0:3.8.9-9.el10_0.19
This is the first release that contains the fix.
sudo dnf update gnutlsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of the gnutls package by restricting access to services that utilize it until the package is updated. Additionally, consider using alternative libraries for secure communications if immediate updates cannot be applied.
Conclusion
The gnutls package has been identified with critical vulnerabilities that pose significant risks to secure communications. Immediate action is required to update the package to the latest patched version to mitigate these risks. Users are encouraged to utilize tools like Vulert for ongoing monitoring of vulnerabilities in their applications.
See every vulnerability recorded for gnutls →
FAQ
GnuTLS is a secure communications library implementing the SSL, TLS, and DTLS protocols. It provides cryptographic functions to ensure secure data transmission.
The vulnerabilities could lead to unauthorized access, data leakage, or denial of service, potentially compromising sensitive information and disrupting services.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check your application without needing to sign up.
If immediate updates are not possible, consider restricting access to services that utilize gnutls and explore alternative libraries for secure communications.
It is recommended to regularly check for vulnerabilities in your packages, ideally on a weekly basis, to ensure that your software remains secure.
Related vulnerabilities
Recent vulnerabilities recorded for gnutls.
