libgcrypt, used by GnuTLS, has some big problems too:

Easy to fix, sure, however seems that upstream is not interested.

(think there was a more recent thread somewhere, can't find it right now, doesn't contain anything new anyway)