This SUSE security update for gnutls fixes twelve vulnerabilities (CVE-2026-33845, CVE-2026-33846, CVE-2026-3833, CVE-2026-42009 through CVE-2026-42015, CVE-2026-5260, and CVE-2026-5419) that impact various aspects of the gnutls library, including buffer handling, certificate name constraints, DTLS packet reassembly, PSK identity lookup, and PKCS#11 token PIN management. The fixes address issues such as case-insensitive domain name comparison, overreading on short ciphertexts, branch-free unpadding, sequence number validation, off-by-one errors, and use-after-free conditions. These vulnerabilities collectively pose a high severity risk and are remediated by the updated gnutls packages provided by SUSE.

The vulnerabilities could lead to memory safety issues like overreading and use-after-free, incorrect certificate validation potentially affecting TLS security, and leakage of sensitive information. These issues may undermine the integrity and confidentiality guarantees of TLS connections using affected gnutls versions. However, there are no reports of active exploitation in the wild at the time of this advisory.

A security update fixing these vulnerabilities is available from the SUSE Product Security Team. Users of affected SUSE versions and gnutls packages should apply the official update (SUSE-SU-2026:2115-1) to remediate these issues. Patch status is confirmed by the vendor advisory. There is no indication that additional mitigation steps are required beyond applying the update.