CVE-2026-95184
Improper certificate validation in gnutls v3.8.13 causes the application to reject legitimate...
GnuTLS v3.8.13 does not properly enforce name constraints, as demonstrated by a permitted subtree violation for "EE O=Evil accepted although outside permitted O=Good." NOTE: the Supplier does not consider this an actionable security vulnerability because of its "threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)" policy.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
GnuTLS v3.8.13 does not properly enforce name constraints, as demonstrated by a permitted subtree violation for "EE O=Evil accepted although outside permitted O=Good." NOTE: the Supplier does not consider this an actionable security vulnerability because of its "threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)" policy.
- Record
CVE-2026-95184- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-04
EUVDEUVD-2026-95140
GnuTLS v3.8.13 does not properly enforce name constraints, as demonstrated by a permitted subtree violation for "EE O=Evil accepted although outside permitted O=Good." NOTE: the Supplier does not consider this an actionable security vulnerability because of its "threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)" policy.
- Record
EUVD-2026-95140- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-04
GitHub AdvisoriesGHSA-prfj-h7xq-vv26
Improper certificate validation in gnutls v3.8.13 causes the application to reject legitimate...
Improper certificate validation in gnutls v3.8.13 causes the application to reject legitimate certificates for valid users, leading to a Denial of Service (DoS).
- Record
GHSA-prfj-h7xq-vv26- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-04
NVD
GnuTLS v3.8.13 does not properly enforce name constraints, as demonstrated by a permitted subtree violation for "EE O=Evil accepted although outside permitted O=Good." NOTE: the Supplier does not consider this an actionable security vulnerability because of its "threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)" policy.
- Record
CVE-2026-95184- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-04
OSVBELL-CVE-2026-95184
- Record
BELL-CVE-2026-95184- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-95184
GnuTLS v3.8.13 does not properly enforce name constraints, as demonstrated by a permitted subtree violation for "EE O=Evil accepted although outside permitted O=Good." NOTE: the Supplier does not consider this an actionable security vulnerability because of its "threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)" policy.
- Record
DEBIAN-CVE-2026-95184- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
Show 4 moreShow less
OSVUBUNTU-CVE-2026-95184
GnuTLS v3.8.13 does not properly enforce name constraints, as demonstrated by a permitted subtree violation for "EE O=Evil accepted although outside permitted O=Good." NOTE: the Supplier does not consider this an actionable security vulnerability because of its "threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)" policy.
- Record
UBUNTU-CVE-2026-95184- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
OSVAZL-107451 No score
CVE-2026-95184 affecting package gnutls 3.8.13-1
GnuTLS v3.8.13 does not properly enforce name constraints, as demonstrated by a permitted subtree violation for "EE O=Evil accepted although outside permitted O=Good." NOTE: the Supplier does not consider this an actionable security vulnerability because of its "threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)" policy.
- Record
AZL-107451- Updated
- 2026-11-05
OSVROOT-OS-DEBIAN-12-CVE-2026-95184 No score
CVE-2026-95184 in gnutls28 - Patched by Root
Root has patched CVE-2026-95184 in the gnutls28 package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2026-95184- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-95184 No score
CVE-2026-95184 in gnutls28 - Patched by Root
Root has patched CVE-2026-95184 in the gnutls28 package for Root:Debian:13. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-13-CVE-2026-95184- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gnutlsAzure Linux:3 |
through 3.8.13-1 | None known |
gnutlsAlpaquita:23 |
3.7.8-r2 and later | None known |
gnutlsAlpaquita:25 |
3.8.8-r0 and later | None known |
gnutlsAlpaquita:stream |
3.8.0-r3 and later | None known |
gnutls28Debian:12 |
All versions, plus listed versions 3.7.9-23.7.9-2+deb12u13.7.9-2+deb12u23.7.9-2+deb12u33.7.9-2+deb12u4 Show 40 moreShow less3.7.9-2+deb12u53.7.9-2+deb12u63.7.9-2+deb12u73.7.9-2+loong643.8.0+git20230413-13.8.0+git20230529-13.8.0+git20230713-13.8.1-13.8.1-23.8.1-33.8.1-43.8.10-13.8.10-23.8.10-33.8.11-13.8.11-23.8.11-33.8.12-13.8.12-23.8.12-33.8.12-43.8.13-13.8.2-13.8.3-13.8.3-1.13.8.3-1.1~exp13.8.4-13.8.4-23.8.5-13.8.5-23.8.5-33.8.5-43.8.6-13.8.6-23.8.7.1-13.8.8-13.8.8-23.8.9-13.8.9-23.8.9-3 |
None known |
gnutls28Debian:13 |
All versions, plus listed versions 3.8.10-13.8.10-23.8.10-33.8.11-13.8.11-2 Show 11 moreShow less3.8.11-33.8.12-13.8.12-23.8.12-33.8.12-43.8.13-13.8.9-33.8.9-3+deb13u13.8.9-3+deb13u23.8.9-3+deb13u33.8.9-3+deb13u4 |
None known |
gnutls28Debian:14 |
All versions, plus listed versions 3.8.10-13.8.10-23.8.10-33.8.11-13.8.11-2 Show 7 moreShow less3.8.11-33.8.12-13.8.12-23.8.12-33.8.12-43.8.13-13.8.9-3 |
None known |
gnutls28Root:Debian:12 |
before 3.7.9-2+deb12u7.aikido.5 | 3.7.9-2+deb12u7.aikido.5 |
rootio-gnutls28Root:Debian:12 |
before 3.7.9-2+deb12u7.aikido.5 | 3.7.9-2+deb12u7.aikido.5 |
gnutls28Root:Debian:13 |
before 3.8.9-3+deb13u4.aikido.3 | 3.8.9-3+deb13u4.aikido.3 |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rootio-gnutls28Root:Debian:13 |
before 3.8.9-3+deb13u4.aikido.3 | 3.8.9-3+deb13u4.aikido.3 |
gnutls26Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 2.12.23-1ubuntu42.12.23-1ubuntu52.12.23-12ubuntu12.12.23-12ubuntu22.12.23-12ubuntu2.1 Show 8 moreShow less2.12.23-12ubuntu2.22.12.23-12ubuntu2.32.12.23-12ubuntu2.42.12.23-12ubuntu2.52.12.23-12ubuntu2.62.12.23-12ubuntu2.72.12.23-12ubuntu2.82.12.23-12ubuntu2.10+esm1 |
None known |
gnutls28Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.3.15-5ubuntu23.3.18-1ubuntu13.3.20-1ubuntu13.4.9-2ubuntu13.4.10-4ubuntu1 Show 13 moreShow less3.4.10-4ubuntu1.13.4.10-4ubuntu1.23.4.10-4ubuntu1.33.4.10-4ubuntu1.43.4.10-4ubuntu1.53.4.10-4ubuntu1.63.4.10-4ubuntu1.73.4.10-4ubuntu1.83.4.10-4ubuntu1.93.4.10-4ubuntu1.9+esm13.4.10-4ubuntu1.9+esm23.4.10-4ubuntu1.9+esm33.4.10-4ubuntu1.9+esm4 |
None known |
gnutls28Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.5.8-6ubuntu33.5.17-1ubuntu13.5.17-1ubuntu33.5.18-1ubuntu13.5.18-1ubuntu1.1 Show 9 moreShow less3.5.18-1ubuntu1.23.5.18-1ubuntu1.33.5.18-1ubuntu1.43.5.18-1ubuntu1.53.5.18-1ubuntu1.63.5.18-1ubuntu1.6+esm13.5.18-1ubuntu1.6+esm23.5.18-1ubuntu1.6+esm33.5.18-1ubuntu1.6+esm4 |
None known |
gnutls28Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 3.6.9-5ubuntu13.6.9-5ubuntu23.6.10-53.6.11.1-23.6.11.1-2ubuntu2 Show 14 moreShow less3.6.13-2ubuntu13.6.13-2ubuntu1.13.6.13-2ubuntu1.23.6.13-2ubuntu1.33.6.13-2ubuntu1.63.6.13-2ubuntu1.73.6.13-2ubuntu1.83.6.13-2ubuntu1.93.6.13-2ubuntu1.103.6.13-2ubuntu1.113.6.13-2ubuntu1.123.6.13-2ubuntu1.12+esm13.6.13-2ubuntu1.12+esm23.6.13-2ubuntu1.12+esm3 |
None known |
gnutls28Ubuntu:22.04:LTS |
All versions, plus listed versions 3.7.1-5ubuntu13.7.2-2ubuntu13.7.2-4ubuntu13.7.2-5ubuntu13.7.3-4ubuntu1 Show 9 moreShow less3.7.3-4ubuntu1.13.7.3-4ubuntu1.23.7.3-4ubuntu1.33.7.3-4ubuntu1.43.7.3-4ubuntu1.53.7.3-4ubuntu1.63.7.3-4ubuntu1.73.7.3-4ubuntu1.83.7.3-4ubuntu1.9 |
None known |
gnutls28Ubuntu:Pro:FIPS-preview:22.04:LTS |
All versions, plus listed versions 3.7.3-4ubuntu1.2+Fips1.1 |
None known |
gnutls28Ubuntu:Pro:FIPS-updates:22.04:LTS |
All versions, plus listed versions 3.7.3-4ubuntu1.2+Fips1.13.7.3-4ubuntu1.3+Fips1.13.7.3-4ubuntu1.4+Fips13.7.3-4ubuntu1.5+Fips13.7.3-4ubuntu1.6+Fips1 Show 4 moreShow less3.7.3-4ubuntu1.7+Fips13.7.3-4ubuntu1.7+Fips1.13.7.3-4ubuntu1.8+Fips1.13.7.3-4ubuntu1.9+Fips1 |
None known |
gnutls28Ubuntu:24.04:LTS |
All versions, plus listed versions 3.8.1-4ubuntu13.8.1-4ubuntu63.8.1-4ubuntu73.8.3-1ubuntu13.8.3-1.1ubuntu2 Show 7 moreShow less3.8.3-1.1ubuntu33.8.3-1.1ubuntu3.13.8.3-1.1ubuntu3.23.8.3-1.1ubuntu3.33.8.3-1.1ubuntu3.43.8.3-1.1ubuntu3.53.8.3-1.1ubuntu3.6 |
None known |
gnutls28Ubuntu:Pro:FIPS-updates:24.04:LTS |
All versions, plus listed versions 3.8.3-1.1ubuntu3.1+Fips13.8.3-1.1ubuntu3.4+Fips13.8.3-1.1ubuntu3.4+Fips1.13.8.3-1.1ubuntu3.5+Fips1.13.8.3-1.1ubuntu3.6+Fips1.2 |
None known |
gnutls28Ubuntu:26.10 |
All versions, plus listed versions 3.8.12-2ubuntu13.8.12-2ubuntu1.13.8.13-1ubuntu1 |
None known |
gnutls28Ubuntu:26.04:LTS |
All versions, plus listed versions 3.8.9-3ubuntu23.8.10-3ubuntu13.8.12-2ubuntu13.8.12-2ubuntu1.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| references | CVE List | |
| description, facts, references, status | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-95184 is a medium vulnerability (CVSS 5.9) in gnutls, published October 8, 2026. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 10th percentile. Fixed in gnutls28 3.7.9-2+deb12u7.aikido.5.