GnuTLS (Product): news timeline & CVEs

VU#948176: Multiple TLS Libraries can Bypass Delegation Enforcement

CERT/CC says TLS libraries inconsistently enforce Name Constraints, with three assigned CVEs already fixed.

CERT/CC VU#948176 documents library-specific disagreements in enforcing X.509 Name Constraints across DNS, IP, URI, and Common Name handling. Assigned fixes include GnuTLS CVE-2026-3833 in 3.8.13, pyca/cryptography CVE-2026-34073 in 46.0.6, and wolfSSL CVE-2026-3547 in 5.9.0; OpenSSL merged PR #30319 for one URI case. Reports involving Go, Apple Security.framework, Mozilla NSS, LibreSSL, AWS-LC, s2n-tls, and Mbed TLS are fixed, in triage, disputed, or not accepted as security issues. CERT/CC does not report active exploitation and says impact depends on trusted issuance and the affected validation path.

CERT/CC Vulnerability Notesupdated Oct 14, 18:50 UTC · 2d agofirst Oct 14, 15:11 UTC · 2d agoVulnerability 4 sources CVE-2026-3833 CVE-2026-34073 CVE-2026-35472

USN-8927-1: curl vulnerabilities

Ubuntu’s USN-8927-1 patches curl flaws that may leak data or reuse the wrong network interface.

Ubuntu security notice USN-8927-1 covers several curl flaws. CVE-2026-107928 is an out-of-bounds read in the WebSocket send path when curl is built with GnuTLS, which could expose sensitive information. CVE-2026-107929 omits the CURLOPT_INTERFACE binding from connection-reuse decisions, potentially sending traffic from an unintended address. A further issue, reported by Stanislav Fort, fails to clear AWS SigV4 authentication state when CURLOPT_AWS_SIGV4 is set to NULL; no exploitation is stated.

Ubuntu Security Noticesupdated Oct 14, 19:26 UTC · 2d agofirst Oct 14, 11:58 UTC · 2d agoAdvisory 2 sources CVE-2026-107928 CVE-2026-1079291

VU#573195: Go, OpenSSL, Apple, LibreSSL, pyca, wolfSSL Name-Constraint Inconsistency in RFC 5280 Implementation

CERT/CC warns TLS libraries inconsistently enforce X.509 name constraints, with fixes for GnuTLS and pyca/cryptography.

CERT/CC VU#573195 describes inconsistent X.509 Name Constraints handling across Go crypto/x509, Apple Security.framework, OpenSSL, LibreSSL, pyca/cryptography, and wolfSSL. Differences cover DNS comparison, IPv4-mapped IPv6 addresses, URI-authority parsing, and wildcards; some are defects and others stem from gaps in RFC 5280. GnuTLS case-sensitivity issue CVE-2026-3833 was fixed in 3.8.13, and pyca/cryptography CVE-2026-34073, where constraints were not checked against the requested peer name, was fixed in 46.0.6. CERT/CC says an attacker would need a trusted signature and a relying application, and that disagreement alone does not show exploitation.

CERT/CC Vulnerability Notesupdated Oct 14, 18:50 UTC · 2d agofirst Oct 13, 18:27 UTC · 3d agoVulnerability 4 sources CVE-2026-3833 CVE-2026-34073

USN-8834-1: Exim vulnerabilities

Ubuntu patched Exim flaws, including a Proxy Protocol out-of-bounds write that could allow remote code execution.

Ubuntu Security Notice USN-8834-1 covers multiple Exim vulnerabilities. CVE-2026-94054 is an out-of-bounds write when Proxy Protocol is used with an attacker-controlled proxy, and a remote attacker could possibly execute arbitrary code. CVE-2026-94055 is a use-after-free under certain non-default GnuTLS settings that can crash Exim and affects only Ubuntu 26.04 LTS. A further Proxy Protocol issue could expose uninitialized stack memory; the notice does not report in-the-wild exploitation.

Ubuntu Security NoticesSep 28, 12:05 UTC · 18d agoVulnerability CVE-2026-94054 CVE-2026-940551

GnuTLS

Timeline4 articles

Related CVEsby mentions

Appears with

VU#948176: Multiple TLS Libraries can Bypass Delegation Enforcement

USN-8927-1: curl vulnerabilities

VU#573195: Go, OpenSSL, Apple, LibreSSL, pyca, wolfSSL Name-Constraint Inconsistency in RFC 5280 Implementation

USN-8834-1: Exim vulnerabilities