Description
Improper certificate validation in gnutls v3.8.13 causes the application to reject legitimate certificates for valid users, leading to a Denial of Service (DoS).
Published: 2026-10-08
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply patch
AI Analysis

Impact

Improper certificate validation in GnuTLS version 3.8.13 causes the application to reject legitimate certificates for valid users, which results in a denial of service. The weakness lies in the incorrect verification of certificates during the TLS handshake, leading to an unnecessary failure of otherwise valid connections.

Affected Systems

The vulnerability affects systems that run GnuTLS 3.8.13 and have not applied a subsequent fix. No other GnuTLS versions are confirmed to be affected; earlier releases remain unverified for this issue.

Risk and Exploitability

It has a CVSS score of 5.9, an EPSS score of <1%, and is not listed in the CISA KEV catalog, indicating no known public exploitation reports. Attackers who can supply certificates may disrupt legitimate users. The attack vector is client‑side: clients can provide a certificate that triggers the faulty validation during the TLS handshake. With an EPSS score of <1%, the precise likelihood of exploitation is low, but the documented defect suggests that mitigation should still be applied promptly.

Generated by OpenCVE AI on October 22, 2026 at 23:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade GnuTLS to the latest release or to a version where the certificate validation issue has been fixed. This is the most reliable way to eliminate the vulnerability.
  • If an upgrade cannot be performed immediately, consider disabling strict certificate validation for the time being as a temporary workaround, but note that this may expose the system to other certificate‑based attacks. Use it only as a stop‑gap measure while a proper update is applied.
  • Verify any custom CA configurations or user‑provided certificate chains, ensuring that trusted certificates are properly recognized and that no configuration inadvertently enforces the faulty validation logic.

Generated by OpenCVE AI on October 22, 2026 at 23:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Title gnutls: gnutls: legitimate user certificates incorrectly rejected causing denial of service
Weaknesses CWE-295
References
Metrics threat_severity

None

 threat_severity

Moderate

Mon, 19 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Title Certificate Validation Bug in GnuTLS 3.8.13 Causes Denial of Service

Mon, 19 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

 cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
References

Fri, 16 Oct 2026 18:00:00 +0000

Type Values Removed Values Added
References

Fri, 09 Oct 2026 07:30:00 +0000

Type Values Removed Values Added
First Time appeared Gnu
Gnu gnutls
Vendors & Products Gnu
Gnu gnutls

Fri, 09 Oct 2026 03:15:00 +0000

Type Values Removed Values Added
Title Certificate Validation Bug in GnuTLS 3.8.13 Causes Denial of Service

Fri, 09 Oct 2026 01:00:00 +0000

Type Values Removed Values Added
Title Denial of Service via Improper Certificate Validation in GnuTLS 3.8.13
Weaknesses CWE-295

Thu, 08 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 08 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Title Denial of Service via Improper Certificate Validation in GnuTLS 3.8.13
Weaknesses CWE-295
CWE-400

Thu, 08 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Description Improper certificate validation in gnutls v3.8.13 causes the application to reject legitimate certificates for valid users, leading to a Denial of Service (DoS).
References

Subscriptions

Gnu Gnutls
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-10-19T15:14:05.681Z

Reserved: 2026-09-22T00:00:00.000Z

Link: CVE-2026-95184

cve-icon Vulnrichment

Updated: 2026-10-08T20:17:51.916Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-08T18:18:33.240

Modified: 2026-10-19T16:17:09.267

Link: CVE-2026-95184

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-08T00:00:00Z

Links: CVE-2026-95184 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T23:30:13Z

Weaknesses
  • CWE-295

    Improper Certificate Validation

  • CWE-400

    Uncontrolled Resource Consumption