CVE-2026-88648
Incomplete X.509 implementation in GnuTLS v3.8.13 allows attackers controlling a subordinate...
CVE-2026-88648 is a low vulnerability (CVSS 3.7) in gnutls, published October 8, 2026. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 10th percentile.
- Severity
- 3.7 LowCVSS 3.1, CVE List
- Exploit chance
- 0.20%EPSS, 10th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
In GnuTLS v3.8.13, an excluded msUPN/SRV otherName is never checked. NOTE: the Supplier does not consider this an actionable security vulnerability because of its "threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)" policy.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gnutlsAzure Linux:3 | through 3.8.13-1 | None known |
gnutls28Debian:12 | All versions, plus listed versions 3.7.9-23.7.9-2+deb12u13.7.9-2+deb12u23.7.9-2+deb12u33.7.9-2+deb12u4 Show 40 moreShow less3.7.9-2+deb12u53.7.9-2+deb12u63.7.9-2+deb12u73.7.9-2+loong643.8.0+git20230413-13.8.0+git20230529-13.8.0+git20230713-13.8.1-13.8.1-23.8.1-33.8.1-43.8.10-13.8.10-23.8.10-33.8.11-13.8.11-23.8.11-33.8.12-13.8.12-23.8.12-33.8.12-43.8.13-13.8.2-13.8.3-13.8.3-1.13.8.3-1.1~exp13.8.4-13.8.4-23.8.5-13.8.5-23.8.5-33.8.5-43.8.6-13.8.6-23.8.7.1-13.8.8-13.8.8-23.8.9-13.8.9-23.8.9-3 | None known |
gnutls28Debian:13 | All versions, plus listed versions 3.8.10-13.8.10-23.8.10-33.8.11-13.8.11-2 Show 11 moreShow less3.8.11-33.8.12-13.8.12-23.8.12-33.8.12-43.8.13-13.8.9-33.8.9-3+deb13u13.8.9-3+deb13u23.8.9-3+deb13u33.8.9-3+deb13u4 | None known |
gnutls28Debian:14 | All versions, plus listed versions 3.8.10-13.8.10-23.8.10-33.8.11-13.8.11-2 Show 7 moreShow less3.8.11-33.8.12-13.8.12-23.8.12-33.8.12-43.8.13-13.8.9-3 | None known |
gnutls26Ubuntu:Pro:14.04:LTS | All versions, plus listed versions 2.12.23-1ubuntu42.12.23-1ubuntu52.12.23-12ubuntu12.12.23-12ubuntu22.12.23-12ubuntu2.1 Show 8 moreShow less2.12.23-12ubuntu2.22.12.23-12ubuntu2.32.12.23-12ubuntu2.42.12.23-12ubuntu2.52.12.23-12ubuntu2.62.12.23-12ubuntu2.72.12.23-12ubuntu2.82.12.23-12ubuntu2.10+esm1 | None known |
gnutls28Ubuntu:Pro:16.04:LTS | All versions, plus listed versions 3.3.15-5ubuntu23.3.18-1ubuntu13.3.20-1ubuntu13.4.9-2ubuntu13.4.10-4ubuntu1 Show 13 moreShow less3.4.10-4ubuntu1.13.4.10-4ubuntu1.23.4.10-4ubuntu1.33.4.10-4ubuntu1.43.4.10-4ubuntu1.53.4.10-4ubuntu1.63.4.10-4ubuntu1.73.4.10-4ubuntu1.83.4.10-4ubuntu1.93.4.10-4ubuntu1.9+esm13.4.10-4ubuntu1.9+esm23.4.10-4ubuntu1.9+esm33.4.10-4ubuntu1.9+esm4 | None known |
gnutls28Ubuntu:Pro:18.04:LTS | All versions, plus listed versions 3.5.8-6ubuntu33.5.17-1ubuntu13.5.17-1ubuntu33.5.18-1ubuntu13.5.18-1ubuntu1.1 Show 9 moreShow less3.5.18-1ubuntu1.23.5.18-1ubuntu1.33.5.18-1ubuntu1.43.5.18-1ubuntu1.53.5.18-1ubuntu1.63.5.18-1ubuntu1.6+esm13.5.18-1ubuntu1.6+esm23.5.18-1ubuntu1.6+esm33.5.18-1ubuntu1.6+esm4 | None known |
gnutls28Ubuntu:Pro:20.04:LTS | All versions, plus listed versions 3.6.9-5ubuntu13.6.9-5ubuntu23.6.10-53.6.11.1-23.6.11.1-2ubuntu2 Show 14 moreShow less3.6.13-2ubuntu13.6.13-2ubuntu1.13.6.13-2ubuntu1.23.6.13-2ubuntu1.33.6.13-2ubuntu1.63.6.13-2ubuntu1.73.6.13-2ubuntu1.83.6.13-2ubuntu1.93.6.13-2ubuntu1.103.6.13-2ubuntu1.113.6.13-2ubuntu1.123.6.13-2ubuntu1.12+esm13.6.13-2ubuntu1.12+esm23.6.13-2ubuntu1.12+esm3 | None known |
gnutls28Ubuntu:22.04:LTS | All versions, plus listed versions 3.7.1-5ubuntu13.7.2-2ubuntu13.7.2-4ubuntu13.7.2-5ubuntu13.7.3-4ubuntu1 Show 9 moreShow less3.7.3-4ubuntu1.13.7.3-4ubuntu1.23.7.3-4ubuntu1.33.7.3-4ubuntu1.43.7.3-4ubuntu1.53.7.3-4ubuntu1.63.7.3-4ubuntu1.73.7.3-4ubuntu1.83.7.3-4ubuntu1.9 | None known |
gnutls28Ubuntu:Pro:FIPS-preview:22.04:LTS | All versions, plus listed versions 3.7.3-4ubuntu1.2+Fips1.1 | None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gnutls28Ubuntu:Pro:FIPS-updates:22.04:LTS | All versions, plus listed versions 3.7.3-4ubuntu1.2+Fips1.13.7.3-4ubuntu1.3+Fips1.13.7.3-4ubuntu1.4+Fips13.7.3-4ubuntu1.5+Fips13.7.3-4ubuntu1.6+Fips1 Show 4 moreShow less3.7.3-4ubuntu1.7+Fips13.7.3-4ubuntu1.7+Fips1.13.7.3-4ubuntu1.8+Fips1.13.7.3-4ubuntu1.9+Fips1 | None known |
gnutls28Ubuntu:24.04:LTS | All versions, plus listed versions 3.8.1-4ubuntu13.8.1-4ubuntu63.8.1-4ubuntu73.8.3-1ubuntu13.8.3-1.1ubuntu2 Show 7 moreShow less3.8.3-1.1ubuntu33.8.3-1.1ubuntu3.13.8.3-1.1ubuntu3.23.8.3-1.1ubuntu3.33.8.3-1.1ubuntu3.43.8.3-1.1ubuntu3.53.8.3-1.1ubuntu3.6 | None known |
gnutls28Ubuntu:Pro:FIPS-updates:24.04:LTS | All versions, plus listed versions 3.8.3-1.1ubuntu3.1+Fips13.8.3-1.1ubuntu3.4+Fips13.8.3-1.1ubuntu3.4+Fips1.13.8.3-1.1ubuntu3.5+Fips1.13.8.3-1.1ubuntu3.6+Fips1.2 | None known |
gnutls28Ubuntu:26.10 | All versions, plus listed versions 3.8.12-2ubuntu13.8.12-2ubuntu1.13.8.13-1ubuntu1 | None known |
gnutls28Ubuntu:26.04:LTS | All versions, plus listed versions 3.8.9-3ubuntu23.8.10-3ubuntu13.8.12-2ubuntu13.8.12-2ubuntu1.1 | None known |
What each source reports
CVE List Score used
In GnuTLS v3.8.13, an excluded msUPN/SRV otherName is never checked. NOTE: the Supplier does not consider this an actionable security vulnerability because of its "threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)" policy.
- Record
CVE-2026-88648- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-295
- Updated
- 2026-11-04
EUVDEUVD-2026-95205
In GnuTLS v3.8.13, an excluded msUPN/SRV otherName is never checked. NOTE: the Supplier does not consider this an actionable security vulnerability because of its "threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)" policy.
- Record
EUVD-2026-95205- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-04
GitHub AdvisoriesGHSA-gxj4-87qm-hmc3
Incomplete X.509 implementation in GnuTLS v3.8.13 allows attackers controlling a subordinate...
Incomplete X.509 implementation in GnuTLS v3.8.13 allows attackers controlling a subordinate Certificate Authority to bypass cross-domain PKI restrictions and issue unauthorized certificates.
- Record
GHSA-gxj4-87qm-hmc3- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-295
- Updated
- 2026-11-04
NVD
In GnuTLS v3.8.13, an excluded msUPN/SRV otherName is never checked. NOTE: the Supplier does not consider this an actionable security vulnerability because of its "threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)" policy.
- Record
CVE-2026-88648- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-295
- Updated
- 2026-11-04
OSVBELL-CVE-2026-88648
CVE-2026-88648 does not affect BellSoft software
- Record
BELL-CVE-2026-88648- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-88648
In GnuTLS v3.8.13, an excluded msUPN/SRV otherName is never checked. NOTE: the Supplier does not consider this an actionable security vulnerability because of its "threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)" policy.
- Record
DEBIAN-CVE-2026-88648- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-05
OSVUBUNTU-CVE-2026-88648
In GnuTLS v3.8.13, an excluded msUPN/SRV otherName is never checked. NOTE: the Supplier does not consider this an actionable security vulnerability because of its "threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)" policy.
- Record
UBUNTU-CVE-2026-88648- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-05
OSVAZL-107436No score
CVE-2026-88648 affecting package gnutls 3.8.13-1
In GnuTLS v3.8.13, an excluded msUPN/SRV otherName is never checked. NOTE: the Supplier does not consider this an actionable security vulnerability because of its "threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)" policy.
- Record
AZL-107436- Updated
- 2026-11-05
History
| Recorded | Changed | Sources |
|---|---|---|
| references | CVE List | |
| description, facts, references, status | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.