Affected: gnutls, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Cert Manager support for Red Hat OpenShift release 1.20, Red Hat Discovery 2, Red Hat Hardened Images, Red Hat Update Infrastructure 5, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 and 2 more

A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online Certificate Status Protocol (OCSP) response during a TLS handshake. Due to a logic error in how gnutls processes multi-record OCSP responses, a client with OCSP verification enabled may incorrectly accept a revoked server certificate, potentially leading to a compromise of trust.

Affected: Ubuntu:22.04:LTS: gnutls28, Ubuntu:24.04:LTS: gnutls28, Ubuntu:25.10: gnutls28, Ubuntu:26.04:LTS: gnutls28

Joshua Rogers discovered that GnuTLS did not properly handle malformed DTLS handshake fragments in certain cases. A remote attacker could possibly use this issue to obtain sensitive information, or cause a denial of service. (CVE-2026-33845)

Haruto Kimura, Oscar Reparaz, and Zou Dikai discovered that GnuTLS did not properly validate DTLS handshake fragment lengths in certain cases. A remote attacker could possibly use this issue to cause GnuTLS to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-33846)

Oleh Konko and Joshua Rogers discovered that GnuTLS did not properly validate OCSP responses in certain cases. A remote attacker could possibly use this issue to bypass certificate revocation checks, leading to a machine-in-the-middle attack. (CVE-2026-3832)

Oleh Konko and Joshua Rogers discovered that GnuTLS did not properly handle case-insensitive name constraints in certain cases. A remote attacker could possibly use this issue to bypass certificate validation, leading to a machine-in-the-middle attack. (CVE-2026-3833)

Joshua Rogers discovered that GnuTLS did not properly order DTLS packets with duplicate sequence numbers in certain cases. A remote attacker could possibly use this issue to cause GnuTLS to crash, resulting in a denial of service. (CVE-2026-42009)

Joshua Rogers discovered that GnuTLS did not properly handle usernames containing NUL characters in certain RSA-PSK configurations. A remote attacker could possibly use this issue t…