GnuTLS version 3.8.13 has been officially released to patch a dozen security vulnerabilities, including critical flaws affecting secure network communications. The update is highly recommended for all systems using GnuTLS , as it addresses memory corruption, authentication bypasses, and certificate validation errors. Four vulnerabilities discovered in this release are categorized as High severity and require immediate attention from security teams. These critical flaws primarily impact the Datagram Transport Layer Security (DTLS) implementation and specific authentication configurations. Threat actors often target these types of memory corruption and bypass vulnerabilities to compromise remote servers or disrupt services. The update fixes a wide range of bugs, from timing side channels to critical heap overruns. The table below highlights the most significant vulnerabilities patched in version 3.8.13: CVE ID Severity Issue Type Summary CVE-2026-33846 High Heap Overwrite Missing checks could let attackers overwrite memory. CVE-2026-42010 High Auth Bypass Flawed username handling allows login bypass. CVE-2026-33845 High Heap Overrun Memory error may let attackers overflow data remotely. CVE-2026-42009 High Undefined Behavior Packet sorting flaw may cause unpredictable issues. CVE-2026-42013 Medium Cert Validation Issue Improper certificate checks could weaken security. CVE-2026-42014 Medium Use-After-Free Memory bug triggered during PIN changes. CVE-2026-3833 Moderate Constraint Bypass Domain checks ignore case rules, risking validation bypass. CVE-2026-5419 Low Timing Leak Timing flaw may expose sensitive information. According to the GnuTLS Security Advisory 2026 , admins should upgrade to GnuTLS 3.8.13 to mitigate these threats. Public-facing servers utilizing DTLS or RSA-PSK authentication are at the highest risk. They should be patched during the next available maintenance window. To proactively defend, security operations centers should update their monitoring tools to detect anomalous DTLS traffic or malformed RSA-PSK authentication attempts. Ensuring that foundational cryptographic libraries remain up to date is a critical strategy for preventing initial network compromise. Follow us on Google News , LinkedIn , and X for daily cybersecurity updates. Contact us to feature your stories. The post GnuTLS 3.8.13 Released with Fix for 12 Vulnerabilities Affecting Network Communications appeared first on Cyber Security News .

GnuTLS v3.8.13 fixes critical heap overwrites, identity truncation, and OCSP bypasses. Secure your Linux comms and upgrade to the latest version now.

Rocky Linux 9.8 is now available with OpenSSH 9.9, GnuTLS 3.8.10, GCC Toolset 15, LLVM 21.1.8, and updated images.

Posted by Alan Coopersmith on Mar 22 https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html announced the release of GnuTLS 3.8.4, including these fixes: https://gnutls.org/security-new.html#GNUTLS-SA-2023-12-04 says: https://gnutls.org/security-new.html#GNUTLS-SA-2024-01-23 says:

Deluder is a tool for intercepting traffic of proxy unaware applications. Currently, Deluder supports OpenSSL, GnuTLS, SChannel, WinSock and Linux Sockets out of the box. ⚡ - GitHub - Warxim/delu...

The entry is about GnuTLS not sending the client cert when it doesn't match the DN the server requested. OpenSSL does the opposite. The issue was already fixed by #4958 and removed from KNOWN_...

gnutls_certificate_verify_peers2() does not seem to verify ExtendedKeyUsage but gnutls_certificate_verify_peers() does. Neither case is documented clearly. This has already lead to people submitting vuln reports to gnutls-using...

A serious security flaw has been found in Exim, one of the most widely deployed mail transfer agents on the internet today. The vulnerability, tracked as EXIM-Security-2026-05-01.1, allows a remote attacker to corrupt server memory and potentially execute malicious code without needing any special privileges or credentials. It was publicly disclosed on May 12, 2026, following a coordinated responsible disclosure process that began in early May. The flaw sits inside Exim’s GnuTLS backend, the component that handles encrypted email communication over TLS. It is triggered when a client uses the BDAT command, which is part of the CHUNKING extension in the SMTP protocol used to send large email bodies in pieces. If an attacker sends a TLS close_notify alert before the body transfer finishes, and then follows it up with one final byte in plain text on the same TCP connection, the server enters a dangerous and unstable state. Exim maintainers, led by Heiko Schlittermann, acknowledged the report and confirmed the issue after receiving it from security researcher Federico Kirschbaum of XBOW Security on May 1, 2026. The team moved quickly, preparing a fix in a private repository and notifying distributors with restricted early access to patches before the public advisory went live on May 12. What makes this vulnerability especially concerning is how little an attacker actually needs to carry it out successfully. No login, no special account, and no prior access to the target system is required at all. All an attacker needs is the ability to open a TLS connection to an Exim server and use the BDAT extension, both of which are completely standard features of modern email infrastructure available to anyone. New Exim BDAT GnuTLS Vulnerability Exim powers email delivery for a significant portion of internet servers around the world, particularly in Linux-based environments. The reach of this flaw is broad, affecting all builds of Exim from version 4.97 through 4.99.2 that were compiled with GnuTLS support. That covers a large share of production mail servers running today, making the exposure window a genuine cause for concern among system administrators and security teams globally. The technical heart of this vulnerability is a use-after-free condition, a well-known class of memory bug where a program continues to use a memory address after it has already been released. When Exim receives a TLS close_notify alert mid-transfer during an active BDAT session, it begins tearing down the TLS session internally. The problem is that the input processing stack is not properly reset at this point, leaving stale and dangerous memory pointers behind. When the attacker then sends one more byte in cleartext over the same TCP connection, Exim tries to write data using a pointer that now points to freed memory. This corrupts the heap, the region of memory where the program stores active data and running state. In the right conditions, an attacker can use this corruption to redirect code execution and run their own commands on the server. It is worth noting that this issue only affects Exim builds compiled with the USE_GNUTLS=yes flag. Servers using OpenSSL or other TLS libraries are not vulnerable to this specific attack path, which narrows the scope but still leaves a large number of systems fully exposed and at risk. Patch and Recommended Action The Exim development team released version 4.99.3 on May 12, 2026, which fully resolves the vulnerability. The fix resets the input processing stack cleanly whenever a TLS close notification arrives during an active BDAT transfer, cutting off the entire chain of events that leads to heap corruption. There is no known workaround or configuration change that can protect a system short of upgrading to the latest release. Server administrators running Exim 4.97 through 4.99.2 with GnuTLS enabled should treat this as an urgent and high-priority update. The patched release is available through the official Exim FTP server and code repository for immediate deployment. Follow us on  Google News ,  LinkedIn , and  X  to Get More Instant Updates ,  Set CSN as a Preferred Source in  Google . The post New Exim BDAT GnuTLS Vulnerability Enables Code Execution Attacks appeared first on Cyber Security News .

At a glance Truffle Security researchers found a critical GnuTLS token leak on June 17, 2026. This exposure threatened the entire open-source supply chain. Organization: GnuTLS and OpenConnect projects Data exposed: Privileged GitLab personal access token Number of records: One API token with Owner access Cause: Environment variables dumped into public log files Disclosure status: Confirmed, patched, and token revoked…