GnuTLS never checks excluded msUPN/SRV otherName entries
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-295.
Summary
GnuTLS v3.8.13 never checks excluded msUPN/SRV otherName entries during certificate validation, which is improper certificate validation (CWE-295). The CVSS vector rates it as a network attack with high complexity that needs no privileges or user interaction. The supplier does not consider it an actionable security vulnerability because its threat model excludes attacks that require modifying the trust boundary.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
In GnuTLS v3.8.13, an excluded msUPN/SRV otherName is never checked. NOTE: the Supplier does not consider this an actionable security vulnerability because of its "threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)" policy.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for GnuTLS. Red Hat rates it Moderate and lists Red Hat Enterprise Linux 6, 7, 8, 9 and 10, Red Hat Hardened Images, Red Hat OpenShift Container Platform 4 and 5, and Red Hat OpenShift AI (RHOAI) as affected without a fix, with no plan available.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet |
| Red Hat Enterprise Linux 6 | Affected | No fix yet |
| Red Hat Enterprise Linux 7 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Hardened Images | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | — |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
Not affected: 1 product
- Red Hat OpenShift AI (RHOAI)
Timeline
- 2026-10-09 Threatist record created from CVE-2026-88648
- 2026-10-16 Affected versions changed · Red Hat
- 2026-10-19 CVSS score added · CISA ADP
- 2026-10-19 CISA SSVC decision points changed
- 2026-10-20 Alias added: GHSA-gxj4-87qm-hmc3
- 2026-10-29 Weakness changed · CISA ADP
- 2026-10-30 Affected versions changed · Red Hat
- 2026-11-04 Title updated · CNA
- 2026-11-04 2 new references · CNA
- 2026-11-04 Title updated · CNA
- 2026-11-06 Affected versions changed · Red Hat
References
Other 5
- https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10
- https://www.rfc-editor.org/rfc/rfc5280#section-6.1.4
- https://gist.github.com/lkloliver/1f2a97cb8d0b31aa27b6bd0354358d7d
- https://gitlab.com/gnutls/gnutls/-/work_items/1965
- https://gitlab.com/gnutls/gnutls/-/blob/e2169a87c7fb91935c2845088204b102baed4c5f/SECURITY.md
Sources
- CVE-2026-88648 · CVE Program
- CVE-2026-88648 · NVD
- FIRST EPSS
- GHSA-gxj4-87qm-hmc3 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-88648 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences