Multiple GnuTLS Vulnerabilities Lead to Denial of Service Risks

Severity: High (Score: 60.6)

Sources: launchpad.net, Ubuntu, Linuxsecurity

Published: 2026-05-21 · Updated: 2026-05-21

Keywords: ubuntu, gnutls, security, issue, important, denial, service

Severity indicators: issue, security issue

Summary

A series of vulnerabilities in GnuTLS, discovered by researchers including Joshua Rogers and Oleh Konko, affect multiple Ubuntu releases. These vulnerabilities could allow remote attackers to exploit malformed DTLS handshake fragments and improperly validated OCSP responses, potentially leading to denial of service or machine-in-the-middle attacks. The affected Ubuntu versions include 26.04 LTS, 25.10, 24.04 LTS, and 22.04 LTS. Specific CVEs include CVE-2026-33845, CVE-2026-33846, CVE-2026-3832, CVE-2026-3833, and CVE-2026-42009. Users are advised to update their systems to mitigate these risks. The vulnerabilities were published between April 30 and May 18, 2026, with the advisory released on May 20, 2026. Key Points: • GnuTLS vulnerabilities could lead to denial of service and sensitive data exposure. • Affected Ubuntu versions include 26.04 LTS and earlier releases. • Users are urged to update their systems to the latest package versions to mitigate risks.

Detailed Analysis

**Impact** Multiple Ubuntu releases and their derivatives are affected, including Ubuntu 22.04 LTS, 24.04 LTS, 25.10, and 26.04 LTS. The vulnerabilities expose systems to denial of service, arbitrary code execution, and man-in-the-middle attacks, potentially impacting any organization relying on GnuTLS for secure communications. Sensitive information and authentication mechanisms are at risk, affecting sectors dependent on encrypted data transmission globally. No specific numbers or geographic concentrations were provided. **Technical Details** The vulnerabilities involve improper handling and validation of DTLS handshake fragments, OCSP responses, and certificate validation processes in GnuTLS. Attackers can exploit these flaws remotely to cause crashes, execute arbitrary code, bypass certificate revocation checks, and bypass authentication (CVE-2026-33845, CVE-2026-33846, CVE-2026-3832, CVE-2026-3833, CVE-2026-42009, CVE-2026-42010, CVE-2026-42011, CVE-2026-42012, among others). The attack vector is network-based targeting TLS/DTLS protocols during handshake and certificate validation stages. No specific malware, tools, or IOCs were mentioned. **Recommended Response** Apply the updated GnuTLS packages provided for affected Ubuntu versions immediately (e.g., libgnutls30t64 3.8.12-2ubuntu1.1 for Ubuntu 26.04 LTS). Conduct standard system updates to ensure all fixes are applied. Monitor network traffic for abnormal TLS/DTLS handshake failures or crashes. Harden configurations related to certificate validation and OCSP handling where possible. No additional detection signatures or IOCs were provided.

Source articles (3)

Ubuntu 26.04 GnuTLS Important Denial Of Service USN-8284 — Linuxsecurity · 2026-05-20
A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 25.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS Summary: Several security issues were fixed in GnuTLS. So…
Gnutls28 — launchpad.net · 2026-05-20
gnutls-bin: GNU TLS library - commandline utilities gnutls-bin-dbgsym: debug symbols for gnutls-bin gnutls-doc: GNU TLS library - documentation and examples libgnutls-dane0t64: GNU TLS library - DANE…
USN-8284-1: GnuTLS vulnerabilities — Ubuntu · 2026-05-20
Joshua Rogers discovered that GnuTLS did not properly handle malformed DTLS handshake fragments in certain cases. A remote attacker could possibly use this issue to obtain sensitive information, or ca…

Timeline

2026-04-30 — CVE-2026-33845 and CVE-2026-3832 published: Vulnerabilities in GnuTLS allow remote attackers to exploit malformed DTLS fragments and bypass certificate revocation checks.
2026-04-30 — CVE-2026-3833 published: Another vulnerability in GnuTLS allows attackers to bypass certificate validation through case-insensitive name constraints.
2026-05-04 — CVE-2026-33846 published: A vulnerability in GnuTLS allows attackers to cause crashes or execute arbitrary code by exploiting DTLS handshake fragment lengths.
2026-05-07 — CVE-2026-42010 and CVE-2026-42011 published: New vulnerabilities in GnuTLS were disclosed, potentially increasing the attack surface for remote exploitation.
2026-05-18 — CVE-2026-42009 published: A vulnerability in GnuTLS was disclosed that could lead to denial of service through improper handling of DTLS packets.
2026-05-20 — Ubuntu security notice USN-8284-1 released: Ubuntu released an advisory detailing multiple GnuTLS vulnerabilities and recommended updates for affected users.

CVEs

Related entities

DDoS (Attack Type)
Man-in-the-Middle (Attack Type)
CWE-200 - Exposure of Sensitive Information (Cwe)
CWE-287 - Improper Authentication (Cwe)
Cwe-416 - Use After Free (Cwe)
T1203 - Exploitation for Client Execution (Mitre Attack)
T1557 - Adversary-in-the-Middle (Mitre Attack)
GnuTLS (Platform)
Ubuntu (Company)

Threat Not Found