GnuTLS may trust certificates on Common Name with SRV otherName
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- Low · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.
Summary
GnuTLS v3.8.13 can perhaps trust a certificate based on its Common Name when the Subject Alternative Name has an SRV otherName whose value is an OCTET STRING (CWE-297). A remote attacker with no privileges and no user interaction can exploit this under high attack complexity, with low confidentiality impact and high integrity impact. The supplier does not consider this an actionable security vulnerability.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
GnuTLS v3.8.13 can perhaps unexpectedly trust a certificate on the basis of Common Name when Subject Alternative Name has an SRV otherName (1.3.6.1.5.5.7.8.7) whose value is an OCTET STRING. NOTE: the Supplier does not consider this an actionable security vulnerability because of its "threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)" policy.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for GnuTLS. Red Hat lists Red Hat Enterprise Linux 9 and 10 and Red Hat OpenShift AI (RHOAI) as affected without a fix, and Red Hat Enterprise Linux 6, 7, 8, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4 and 5 as affected with no fix planned.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | — |
| Red Hat Enterprise Linux 6 | Affected | No fix yet |
| Red Hat Enterprise Linux 7 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | — |
| Red Hat Hardened Images | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | — |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
Not affected: 1 product
- Red Hat OpenShift AI (RHOAI)
Timeline
- 2026-10-08 Threatist record created from CVE-2026-88647
- 2026-10-09 Alias added: GHSA-2j2x-fffq-ff4q
- 2026-10-09 Affected versions changed · Red Hat
- 2026-10-09 CVSS score added · Red Hat
- 2026-10-10 CVSS score added · CISA ADP
- 2026-10-10 Weakness changed · CISA ADP
- 2026-10-10 CISA SSVC decision points changed
- 2026-10-10 Priority changed: LOW → HIGH
- 2026-10-19 CVSS score changed · CISA ADP
- 2026-10-19 CISA SSVC decision points changed
- 2026-10-19 Priority changed: HIGH → LOW
- 2026-10-23 Affected versions changed · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
- 2026-11-04 Title updated · CNA
- 2026-11-04 2 new references · CNA
- 2026-11-06 Affected versions changed · Red Hat
References
Sources
- CVE-2026-88647 · CVE Program
- CVE-2026-88647 · NVD
- FIRST EPSS
- GHSA-2j2x-fffq-ff4q · GitHub Advisory Database · CC BY 4.0
- CVE-2026-88647 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences