{"id":"CVE-2026-1584","aliases":["ALPINE-CVE-2026-1584","BELL-CVE-2026-1584","DEBIAN-CVE-2026-1584","EUVD-2026-20986","GHSA-92xv-mw29-x4px","RHSA-2026:7477","UBUNTU-CVE-2026-1584","openSUSE-SU-2026:10177-1"],"status":"published","title":"Gnutls: gnutls: remote denial of service via crafted clienthello with invalid psk binder","description":"A flaw was found in gnutls. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted ClientHello message with an invalid Pre-Shared Key (PSK) binder value during the TLS handshake. This can lead to a NULL pointer dereference, causing the server to crash and resulting in a remote Denial of Service (DoS) condition.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01374,"percentile":0.72239,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2026-02-10T00:00:00Z","modified":"2026-11-05T21:15:30Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"gnutls","fixed_in":["3.8.12-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"gnutls","fixed_in":["3.8.12-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"gnutls","fixed_in":["3.8.12-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"gnutls","fixed_in":["3.8.12-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"gnutls","fixed_in":["3.8.12-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"gnutls","fixed_in":["3.8.13-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"gnutls","fixed_in":["3.8.12-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"gnutls","fixed_in":["3.8.12-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gnutls28","fixed_in":["3.8.12-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.12-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.12-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.12-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.12-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.12-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.8-r2"},{"fixed":"3.8.13-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.8-r0"},{"fixed":"3.8.12-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.0-r3"},{"fixed":"3.8.12-r0"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.12-1"}]}],"versions":["3.8.10-1","3.8.10-2","3.8.10-3","3.8.11-1","3.8.11-2","3.8.11-3","3.8.9-3"]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.12-1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnutls-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.12-1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnutls-dane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.12-1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.12-1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnutls-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.12-1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.12-1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mingw32-gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.12-1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mingw64-gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.12-1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.12-1.1"}]}],"bundled":2}],"products":[{"vendor":"gnu","product":"gnutls"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"redhat","product":"hardened_images"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:7477","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1584","tags":["vdb-entry","x_refsource_REDHAT","Vendor Advisory","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2435258","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Vendor Advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1584.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1584","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-92xv-mw29-x4px"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-1584","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-1584","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://catalog.redhat.com/software/containers/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1584.json","tags":["advisory"]},{"url":"https://gitlab.com/gnutls/gnutls","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-1584","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-32990","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-32989","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-32988","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-9820","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-14831","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7477.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2392528","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9820","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9820","tags":["advisory"]},{"url":"https://gitlab.com/gnutls/gnutls/-/commit/1d56f96f6ab5034d677136b9d50b5a75dff0faf5","tags":["article"]},{"url":"https://gitlab.com/gnutls/gnutls/-/issues/1732","tags":["article"]},{"url":"https://www.gnutls.org/security-new.html#GNUTLS-SA-2025-11-18","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2423177","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-14831","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14831","tags":["advisory"]},{"url":"https://gitlab.com/gnutls/gnutls/-/issues/1773","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359622","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-32988","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32988","tags":["advisory"]},{"url":"https://lists.gnupg.org/pipermail/gnutls-help/2025-July/004883.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359621","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-32989","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32989","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359620","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-32990","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32990","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1584","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2026-1584","tags":["report"]},{"url":"https://gitlab.com/gnutls/gnutls/-/issues/1790","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1584","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-1584","title":"Gnutls: gnutls: remote denial of service via crafted clienthello with invalid psk binder","description":"A flaw was found in gnutls. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted ClientHello message with an invalid Pre-Shared Key (PSK) binder value during the TLS handshake. This can lead to a NULL pointer dereference, causing the server to crash and resulting in a remote Denial of Service (DoS) condition.","status":"published","published":"2026-04-09T18:00:21.184Z","modified":"2026-11-04T21:59:38.3Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-476","CWE-476"],"updated_at":"2026-11-04T22:39:15.990179Z"}],"euvd":[{"id":"EUVD-2026-20986","description":"A flaw was found in gnutls. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted ClientHello message with an invalid Pre-Shared Key (PSK) binder value during the TLS handshake. This can lead to a NULL pointer dereference, causing the server to crash and resulting in a remote Denial of Service (DoS) condition.","status":"published","published":"2026-04-09T18:00:21Z","modified":"2026-11-04T21:59:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-04T23:47:18.620008Z"}],"ghsa":[{"id":"GHSA-92xv-mw29-x4px","title":"A flaw was found in gnutls. A remote, unauthenticated attacker can exploit this vulnerability by...","description":"A flaw was found in gnutls. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted ClientHello message with an invalid Pre-Shared Key (PSK) binder value during the TLS handshake. This can lead to a NULL pointer dereference, causing the server to crash and resulting in a remote Denial of Service (DoS) condition.","status":"published","published":"2026-04-09T18:31:27Z","modified":"2026-06-30T03:37:19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:09:05.34707Z"}],"nvd":[{"id":"CVE-2026-1584","description":"A flaw was found in gnutls. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted ClientHello message with an invalid Pre-Shared Key (PSK) binder value during the TLS handshake. This can lead to a NULL pointer dereference, causing the server to crash and resulting in a remote Denial of Service (DoS) condition.","status":"published","published":"2026-04-09T18:16:44.047Z","modified":"2026-11-04T22:18:02.857Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-476"],"updated_at":"2026-11-04T23:43:38.567042Z"}],"osv":[{"id":"ALPINE-CVE-2026-1584","description":"A flaw was found in gnutls. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted ClientHello message with an invalid Pre-Shared Key (PSK) binder value during the TLS handshake. This can lead to a NULL pointer dereference, causing the server to crash and resulting in a remote Denial of Service (DoS) condition.","status":"published","published":"2026-04-09T18:16:44.047Z","modified":"2026-10-01T02:17:49.192858888Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2026-1584","status":"published","published":"2026-02-11T13:41:58.682245Z","modified":"2026-05-12T07:15:12.062304Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"CVE-2026-1584","title":"Gnutls: gnutls: remote denial of service via crafted clienthello with invalid psk binder","description":"A flaw was found in gnutls. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted ClientHello message with an invalid Pre-Shared Key (PSK) binder value during the TLS handshake. This can lead to a NULL pointer dereference, causing the server to crash and resulting in a remote Denial of Service (DoS) condition.","status":"published","published":"2026-04-09T18:00:21.184Z","modified":"2026-11-05T21:15:30.869615632Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-05T22:01:21.792402Z"},{"id":"DEBIAN-CVE-2026-1584","description":"A flaw was found in gnutls. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted ClientHello message with an invalid Pre-Shared Key (PSK) binder value during the TLS handshake. This can lead to a NULL pointer dereference, causing the server to crash and resulting in a remote Denial of Service (DoS) condition.","status":"published","published":"2026-04-09T18:16:44.047Z","modified":"2026-11-05T09:47:32.339329504Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T13:31:24.64316Z"},{"id":"RHSA-2026:7477","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-21T10:09:56Z","modified":"2026-10-15T10:26:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"openSUSE-SU-2026:10177-1","title":"gnutls-3.8.12-1.1 on GA media","description":"These are all security issues fixed in the gnutls-3.8.12-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-11T00:00:00Z","modified":"2026-03-23T04:54:32.273943Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"UBUNTU-CVE-2026-1584","description":"[Unknown description]","status":"withdrawn","published":"2026-02-10T00:00:00Z","modified":"2026-02-12T07:00:59.664928Z","updated_at":"2026-11-02T16:56:00.592716Z"}]}}