Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

GNUTLS: Malicious Certificate Can Cause System Crash

published 4 months ago

Summary

GNUTLS, a library used for secure network communications, has a security issue that can allow a malicious certificate to cause a system crash. This could potentially be exploited by an attacker to disrupt services. Users should update their systems to the latest version of GNUTLS to prevent this issue.

What to do

Update redhat gnutls to version 0:3.3.29-9.el7_9.1.
Update redhat gnutls-c++ to version 0:3.3.29-9.el7_9.1.
Update redhat gnutls-dane to version 0:3.3.29-9.el7_9.1.
Update redhat gnutls-devel to version 0:3.3.29-9.el7_9.1.
Update redhat gnutls-utils to version 0:3.3.29-9.el7_9.1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_els:7	redhat	gnutls	< 0:3.3.29-9.el7_9.1 Fix: upgrade to 0:3.3.29-9.el7_9.1
Red Hat:rhel_els:7	redhat	gnutls-c++	< 0:3.3.29-9.el7_9.1 Fix: upgrade to 0:3.3.29-9.el7_9.1
Red Hat:rhel_els:7	redhat	gnutls-dane	< 0:3.3.29-9.el7_9.1 Fix: upgrade to 0:3.3.29-9.el7_9.1
Red Hat:rhel_els:7	redhat	gnutls-devel	< 0:3.3.29-9.el7_9.1 Fix: upgrade to 0:3.3.29-9.el7_9.1
Red Hat:rhel_els:7	redhat	gnutls-utils	< 0:3.3.29-9.el7_9.1 Fix: upgrade to 0:3.3.29-9.el7_9.1

Original advisory text

Red Hat Security Advisory: gnutls security update

References

https://access.redhat.com/errata/RHSA-2026:34372 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2450624 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2450625 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2467279 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34372.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-33845 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-33845 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33845 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-33846 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-33846 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33846 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-42009 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-42009 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-42009 Vendor Advisory
https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-2 Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Timeline

Published2 Jul 2026

Updated8 Jul 2026

First seen8 Jul 2026

Sources

RHSA-2026:34372 · OSV

Track software like this

Free during beta