CVE-2026-88647
A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name...
GnuTLS v3.8.13 can perhaps unexpectedly trust a certificate on the basis of Common Name when Subject Alternative Name has an SRV otherName (1.3.6.1.5.5.7.8.7) whose value is an OCTET STRING. NOTE: the Supplier does not consider this an actionable security vulnerability because of its "threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)" policy.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
GnuTLS v3.8.13 can perhaps unexpectedly trust a certificate on the basis of Common Name when Subject Alternative Name has an SRV otherName (1.3.6.1.5.5.7.8.7) whose value is an OCTET STRING. NOTE: the Supplier does not consider this an actionable security vulnerability because of its "threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)" policy.
- Record
CVE-2026-88647- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N - Weakness
- CWE-297
- Updated
- 2026-11-04
EUVDEUVD-2026-95113
GnuTLS v3.8.13 can perhaps unexpectedly trust a certificate on the basis of Common Name when Subject Alternative Name has an SRV otherName (1.3.6.1.5.5.7.8.7) whose value is an OCTET STRING. NOTE: the Supplier does not consider this an actionable security vulnerability because of its "threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)" policy.
- Record
EUVD-2026-95113- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N - Updated
- 2026-11-04
GitHub AdvisoriesGHSA-2j2x-fffq-ff4q
A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name...
A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certificate.
- Record
GHSA-2j2x-fffq-ff4q- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-297
- Updated
- 2026-11-04
NVD
GnuTLS v3.8.13 can perhaps unexpectedly trust a certificate on the basis of Common Name when Subject Alternative Name has an SRV otherName (1.3.6.1.5.5.7.8.7) whose value is an OCTET STRING. NOTE: the Supplier does not consider this an actionable security vulnerability because of its "threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)" policy.
- Record
CVE-2026-88647- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N - Weakness
- CWE-297
- Updated
- 2026-11-04
OSVBELL-CVE-2026-88647
CVE-2026-88647 does not affect BellSoft software
- Record
BELL-CVE-2026-88647- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-88647
GnuTLS v3.8.13 can perhaps unexpectedly trust a certificate on the basis of Common Name when Subject Alternative Name has an SRV otherName (1.3.6.1.5.5.7.8.7) whose value is an OCTET STRING. NOTE: the Supplier does not consider this an actionable security vulnerability because of its "threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)" policy.
- Record
DEBIAN-CVE-2026-88647- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N - Updated
- 2026-11-05
Show 4 moreShow less
OSVUBUNTU-CVE-2026-88647
GnuTLS v3.8.13 can perhaps unexpectedly trust a certificate on the basis of Common Name when Subject Alternative Name has an SRV otherName (1.3.6.1.5.5.7.8.7) whose value is an OCTET STRING. NOTE: the Supplier does not consider this an actionable security vulnerability because of its "threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)" policy.
- Record
UBUNTU-CVE-2026-88647- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N - Updated
- 2026-11-05
OSVAZL-107445 No score
CVE-2026-88647 affecting package gnutls 3.8.13-1
GnuTLS v3.8.13 can perhaps unexpectedly trust a certificate on the basis of Common Name when Subject Alternative Name has an SRV otherName (1.3.6.1.5.5.7.8.7) whose value is an OCTET STRING. NOTE: the Supplier does not consider this an actionable security vulnerability because of its "threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)" policy.
- Record
AZL-107445- Updated
- 2026-11-05
OSVROOT-OS-DEBIAN-12-CVE-2026-88647 No score
CVE-2026-88647 in gnutls28 - Patched by Root
Root has patched CVE-2026-88647 in the gnutls28 package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2026-88647- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-88647 No score
CVE-2026-88647 in gnutls28 - Patched by Root
Root has patched CVE-2026-88647 in the gnutls28 package for Root:Debian:13. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-13-CVE-2026-88647- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gnutlsAzure Linux:3 |
through 3.8.13-1 | None known |
gnutls28Debian:12 |
All versions, plus listed versions 3.7.9-23.7.9-2+deb12u13.7.9-2+deb12u23.7.9-2+deb12u33.7.9-2+deb12u4 Show 40 moreShow less3.7.9-2+deb12u53.7.9-2+deb12u63.7.9-2+deb12u73.7.9-2+loong643.8.0+git20230413-13.8.0+git20230529-13.8.0+git20230713-13.8.1-13.8.1-23.8.1-33.8.1-43.8.10-13.8.10-23.8.10-33.8.11-13.8.11-23.8.11-33.8.12-13.8.12-23.8.12-33.8.12-43.8.13-13.8.2-13.8.3-13.8.3-1.13.8.3-1.1~exp13.8.4-13.8.4-23.8.5-13.8.5-23.8.5-33.8.5-43.8.6-13.8.6-23.8.7.1-13.8.8-13.8.8-23.8.9-13.8.9-23.8.9-3 |
None known |
gnutls28Debian:13 |
All versions, plus listed versions 3.8.10-13.8.10-23.8.10-33.8.11-13.8.11-2 Show 11 moreShow less3.8.11-33.8.12-13.8.12-23.8.12-33.8.12-43.8.13-13.8.9-33.8.9-3+deb13u13.8.9-3+deb13u23.8.9-3+deb13u33.8.9-3+deb13u4 |
None known |
gnutls28Debian:14 |
All versions, plus listed versions 3.8.10-13.8.10-23.8.10-33.8.11-13.8.11-2 Show 7 moreShow less3.8.11-33.8.12-13.8.12-23.8.12-33.8.12-43.8.13-13.8.9-3 |
None known |
gnutls28Root:Debian:12 |
before 3.7.9-2+deb12u7.aikido.5 | 3.7.9-2+deb12u7.aikido.5 |
rootio-gnutls28Root:Debian:12 |
before 3.7.9-2+deb12u7.aikido.5 | 3.7.9-2+deb12u7.aikido.5 |
gnutls28Root:Debian:13 |
before 3.8.9-3+deb13u4.aikido.3 | 3.8.9-3+deb13u4.aikido.3 |
rootio-gnutls28Root:Debian:13 |
before 3.8.9-3+deb13u4.aikido.3 | 3.8.9-3+deb13u4.aikido.3 |
gnutls26Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 2.12.23-1ubuntu42.12.23-1ubuntu52.12.23-12ubuntu12.12.23-12ubuntu22.12.23-12ubuntu2.1 Show 8 moreShow less2.12.23-12ubuntu2.22.12.23-12ubuntu2.32.12.23-12ubuntu2.42.12.23-12ubuntu2.52.12.23-12ubuntu2.62.12.23-12ubuntu2.72.12.23-12ubuntu2.82.12.23-12ubuntu2.10+esm1 |
None known |
gnutls28Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.3.15-5ubuntu23.3.18-1ubuntu13.3.20-1ubuntu13.4.9-2ubuntu13.4.10-4ubuntu1 Show 13 moreShow less3.4.10-4ubuntu1.13.4.10-4ubuntu1.23.4.10-4ubuntu1.33.4.10-4ubuntu1.43.4.10-4ubuntu1.53.4.10-4ubuntu1.63.4.10-4ubuntu1.73.4.10-4ubuntu1.83.4.10-4ubuntu1.93.4.10-4ubuntu1.9+esm13.4.10-4ubuntu1.9+esm23.4.10-4ubuntu1.9+esm33.4.10-4ubuntu1.9+esm4 |
None known |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gnutls28Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.5.8-6ubuntu33.5.17-1ubuntu13.5.17-1ubuntu33.5.18-1ubuntu13.5.18-1ubuntu1.1 Show 9 moreShow less3.5.18-1ubuntu1.23.5.18-1ubuntu1.33.5.18-1ubuntu1.43.5.18-1ubuntu1.53.5.18-1ubuntu1.63.5.18-1ubuntu1.6+esm13.5.18-1ubuntu1.6+esm23.5.18-1ubuntu1.6+esm33.5.18-1ubuntu1.6+esm4 |
None known |
gnutls28Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 3.6.9-5ubuntu13.6.9-5ubuntu23.6.10-53.6.11.1-23.6.11.1-2ubuntu2 Show 14 moreShow less3.6.13-2ubuntu13.6.13-2ubuntu1.13.6.13-2ubuntu1.23.6.13-2ubuntu1.33.6.13-2ubuntu1.63.6.13-2ubuntu1.73.6.13-2ubuntu1.83.6.13-2ubuntu1.93.6.13-2ubuntu1.103.6.13-2ubuntu1.113.6.13-2ubuntu1.123.6.13-2ubuntu1.12+esm13.6.13-2ubuntu1.12+esm23.6.13-2ubuntu1.12+esm3 |
None known |
gnutls28Ubuntu:22.04:LTS |
All versions, plus listed versions 3.7.1-5ubuntu13.7.2-2ubuntu13.7.2-4ubuntu13.7.2-5ubuntu13.7.3-4ubuntu1 Show 9 moreShow less3.7.3-4ubuntu1.13.7.3-4ubuntu1.23.7.3-4ubuntu1.33.7.3-4ubuntu1.43.7.3-4ubuntu1.53.7.3-4ubuntu1.63.7.3-4ubuntu1.73.7.3-4ubuntu1.83.7.3-4ubuntu1.9 |
None known |
gnutls28Ubuntu:Pro:FIPS-preview:22.04:LTS |
All versions, plus listed versions 3.7.3-4ubuntu1.2+Fips1.1 |
None known |
gnutls28Ubuntu:Pro:FIPS-updates:22.04:LTS |
All versions, plus listed versions 3.7.3-4ubuntu1.2+Fips1.13.7.3-4ubuntu1.3+Fips1.13.7.3-4ubuntu1.4+Fips13.7.3-4ubuntu1.5+Fips13.7.3-4ubuntu1.6+Fips1 Show 4 moreShow less3.7.3-4ubuntu1.7+Fips13.7.3-4ubuntu1.7+Fips1.13.7.3-4ubuntu1.8+Fips1.13.7.3-4ubuntu1.9+Fips1 |
None known |
gnutls28Ubuntu:24.04:LTS |
All versions, plus listed versions 3.8.1-4ubuntu13.8.1-4ubuntu63.8.1-4ubuntu73.8.3-1ubuntu13.8.3-1.1ubuntu2 Show 7 moreShow less3.8.3-1.1ubuntu33.8.3-1.1ubuntu3.13.8.3-1.1ubuntu3.23.8.3-1.1ubuntu3.33.8.3-1.1ubuntu3.43.8.3-1.1ubuntu3.53.8.3-1.1ubuntu3.6 |
None known |
gnutls28Ubuntu:Pro:FIPS-updates:24.04:LTS |
All versions, plus listed versions 3.8.3-1.1ubuntu3.1+Fips13.8.3-1.1ubuntu3.4+Fips13.8.3-1.1ubuntu3.4+Fips1.13.8.3-1.1ubuntu3.5+Fips1.13.8.3-1.1ubuntu3.6+Fips1.2 |
None known |
gnutls28Ubuntu:26.10 |
All versions, plus listed versions 3.8.12-2ubuntu13.8.12-2ubuntu1.13.8.13-1ubuntu1 |
None known |
gnutls28Ubuntu:26.04:LTS |
All versions, plus listed versions 3.8.9-3ubuntu23.8.10-3ubuntu13.8.12-2ubuntu13.8.12-2ubuntu1.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| references | CVE List | |
| description, facts, references, status | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-88647 is a medium vulnerability (CVSS 6.5) in gnutls, published October 8, 2026. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. Fixed in gnutls28 3.7.9-2+deb12u7.aikido.5.
References
gitlab.com/gnutls/gnutls/-/issues/1802
gist.github.com/lkloliver/f98ec3de1a871fdfc02b70b8b9ba7642
github.com/lkloliver/poc/tree/main/CVE-2026-88647
nvd.nist.gov/vuln/detail/CVE-2026-88647