CVE-2026-3833: Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison

Severity: high (CVSS 7.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-30 · updated 2026-10-26
Weakness: CWE-178

Description

A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within `excludedSubtrees` or `permittedSubtrees`. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.

Affected products

[UNKNOWN] gnutls: all versions
Red Hat Enterprise Linux: 6.0, 7.0, 8.0, 9.0, 10.0
RedHat Hardened Images: all versions
Red Hat OpenShift Container Platform 4.18: 4.0

In the news

References

Get alerted when CVE-2026-3833 or the next vulnerability affects your stack