The gnutls packages provide the GNU Transport Layer Security library implementing SSL, TLS, and DTLS protocols. Several vulnerabilities were found including inefficient DER decoding in libtasn1 leading to potential remote denial of service (CVE-2024-12133), multiple denial of service vectors in gnutls (CVE-2025-14831, CVE-2026-33845, CVE-2026-33846, CVE-2026-42009), authentication bypass via NUL character in username (CVE-2026-42010), security and certificate validation bypasses due to improper handling of name constraints and SANs (CVE-2026-3833, CVE-2026-42011, CVE-2026-42012, CVE-2026-42013), information disclosure via heap overread in RSA key exchange (CVE-2026-5260), use-after-free and memory corruption bugs (CVE-2026-42014, CVE-2026-42015). Red Hat has issued an important security advisory (RHSA-2026:30850) with updates for Red Hat Enterprise Linux 8.8 to address these issues.

The vulnerabilities collectively allow for denial of service attacks through resource exhaustion and memory corruption, authentication bypasses, security policy bypasses, certificate validation bypasses, and potential information disclosure. These issues could undermine the security guarantees of TLS/DTLS communications on affected systems, potentially allowing attackers to disrupt services or bypass authentication and validation mechanisms.

Red Hat has released security updates for the gnutls and libtasn1 packages in Red Hat Enterprise Linux 8.8 to address these vulnerabilities. Users should apply the updates provided in advisory RHSA-2026:30850 promptly to remediate these issues. For update instructions and package details, refer to https://access.redhat.com/articles/11258. Patch status is confirmed as official-fix by Red Hat.