Read the docs
TI-2026-69626 Aliases CVE-2026-95184GHSA-prfj-h7xq-vv26

Name constraints not enforced in GnuTLS certificate validation

Priority LOW 26CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-400.

Summary

GnuTLS v3.8.13 does not properly enforce X.509 name constraints, so a certificate is accepted even when its subject falls outside the permitted subtree, such as an end-entity certificate with O=Evil under a permitted O=Good. The vendor does not treat this as an actionable security vulnerability because its threat model excludes attacks that require modifying material inside the trust boundary, such as trusted certificate authorities. The CVSS vector rates it as network-reachable with high complexity, no privileges and no user interaction, with high availability impact.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

GnuTLS v3.8.13 does not properly enforce name constraints, as demonstrated by a permitted subtree violation for "EE O=Evil accepted although outside permitted O=Good." NOTE: the Supplier does not consider this an actionable security vulnerability because of its "threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)" policy.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00208 10th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for GnuTLS. Red Hat rates the issue Moderate and lists Red Hat Hardened Images as affected with no fix plan available.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Hardened ImagesAffectedNo fix yet

Timeline

  1. 2026-10-08 Threatist record created from CVE-2026-95184
  2. 2026-10-09 Alias added: GHSA-prfj-h7xq-vv26
  3. 2026-10-09 CVSS score added · CISA ADP
  4. 2026-10-09 Weakness changed · CISA ADP
  5. 2026-10-09 CISA SSVC decision points changed
  6. 2026-10-16 1 new reference · CNA
  7. 2026-10-19 CVSS score changed · CISA ADP
  8. 2026-10-19 CISA SSVC decision points changed
  9. 2026-10-21 Affected versions changed · Red Hat
  10. 2026-10-21 CVSS score added · Red Hat
  11. 2026-11-04 Title updated · CNA
  12. 2026-11-04 2 new references · CNA

References

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences