On 19 May 2026 Debian published DSA-6281-1 for gnutls28, the GnuTLS TLS library, fixing 13 vulnerabilities in both Debian 12 (bookworm) and Debian 13 (trixie). GnuTLS rates four of them High: two heap memory errors in DTLS handling, a DTLS ordering bug and an authentication bypass for servers using RSA-PSK. It followed a smaller update in February, DSA-6140-1.
At a glance
| Item | Details |
|---|---|
| Source package | gnutls28 |
| Debian 13 (trixie) | Fixed in 3.8.9-3+deb13u4 |
| Debian 12 (bookworm) | Fixed in 3.7.9-2+deb12u7 |
| Binary packages | libgnutls30t64 (trixie) or libgnutls30 (bookworm), plus libgnutls-dane0*, libgnutls-openssl27*, gnutls-bin if installed |
| CVEs | 13 in the DSA-6281-1 announcement (one affects trixie only) |
| Severity | High (GnuTLS rating for CVE-2026-33846, CVE-2026-33845, CVE-2026-42009, CVE-2026-42010) |
| Earlier 2026 update | DSA-6140-1, 18 Feb 2026 (CVE-2025-14831) |
What the vulnerabilities are
Debian's announcement says the flaws "may result in execution of arbitrary code, denial of service, information leak, certificate misuse, name constraint bypass, authentication bypass, revocation bypass or timing side-channel attacks". GnuTLS's own security advisories page groups them like this:
- DTLS memory errors (High). CVE-2026-33846 is a heap overwrite because GnuTLS did not check that DTLS fragments claimed a consistent message length; CVE-2026-33845 is a remotely triggerable underflow in DTLS reassembly that leads to a heap overrun; CVE-2026-42009 is undefined behaviour when ordering DTLS packets with duplicate sequence numbers. These matter for software that uses DTLS, the UDP form of TLS.
- RSA-PSK authentication bypass (High). CVE-2026-42010: servers configured with RSA-PSK matched usernames containing a NUL character against names truncated at that character, which could let a client authenticate as another user.
- Certificate and name checks (Medium). CVE-2026-3833 and CVE-2026-42011 allowed name-constraint bypasses; CVE-2026-42012 and CVE-2026-42013 let some certificates fall back to matching the hostname against the Common Name.
- Memory bugs in less common paths (Medium/Low). CVE-2026-42014 (PKCS#11 PIN change use-after-free), CVE-2026-5260 (heap overread with PKCS#11-backed RSA keys) and CVE-2026-42015 (PKCS#12 out-of-bounds write).
- Revocation and timing (Low). CVE-2026-3832 could accept a revoked certificate from a multi-entry OCSP response; CVE-2026-5419 is a timing leak in PKCS#7 padding checks. The Debian tracker marks CVE-2026-3832 as not affecting bookworm.
The February update, DSA-6140-1, fixed CVE-2025-14831 (Medium): certificates with a very large number of name constraints could exhaust resources. The bookworm build also fixed CVE-2025-9820. None of these CVEs is in the CISA Known Exploited Vulnerabilities catalog as of 30 October 2026.
Are you affected?
GnuTLS is widely installed. On Debian 12 even apt depends on libgnutls30; on both releases packages such as wget and exim4-daemon-light use it. Check the installed version:
dpkg -l 'libgnutls*' gnutls-bin
apt policy libgnutls30t64 # Debian 13
apt policy libgnutls30 # Debian 12You need at least 3.8.9-3+deb13u4 on trixie or 3.7.9-2+deb12u7 on bookworm. Debian 11 (bullseye) is past the end of LTS (31 August 2026) and should be upgraded rather than patched.
How to update
sudo apt update
sudo apt upgradeTo update only the library on Debian 13:
sudo apt install --only-upgrade libgnutls30t64On Debian 12 use libgnutls30 instead. Include the other GnuTLS binary packages listed by dpkg -l so they stay at the same version. Ubuntu builds differ; see Ubuntu Security Notices.
Restart or reboot?
No reboot is needed, but long-running processes keep the old library in memory until they restart. List them with needrestart and restart what it shows, for example the mail server:
sudo needrestart -r l
sudo systemctl restart exim4A planned reboot is the simplest option if many services are listed.
Sources
- security-tracker.debian.org/tracker/DSA-6281-1
- debian.org/security/2026/dsa-6281
- lists.debian.org/debian-security-announce/2026/msg00192.html
- security-tracker.debian.org/tracker/DSA-6140-1
- debian.org/security/2026/dsa-6140
- lists.debian.org/debian-security-announce/2026/msg00049.html
- gnutls.org/security-new.html
- security-tracker.debian.org/tracker/CVE-2026-3832
- cve.org/CVERecord?id=CVE-2026-33846
- cve.org/CVERecord?id=CVE-2026-33845
- cve.org/CVERecord?id=CVE-2026-42010
- cve.org/CVERecord?id=CVE-2026-42009
- cve.org/CVERecord?id=CVE-2025-14831
- security-tracker.debian.org/tracker/source-package/gnutls28
- packages.debian.org/source/trixie/gnutls28
- packages.debian.org/source/bookworm/gnutls28
- packages.debian.org/bookworm/apt
- packages.debian.org/trixie/exim4-daemon-light
- packages.debian.org/trixie/wget
- manpages.debian.org/trixie/needrestart/needrestart.1.en.html
Comments
0 total · 0 threads