{"id":"CVE-2026-67693","aliases":["AZL-107448","BELL-CVE-2026-67693","DEBIAN-CVE-2026-67693","EUVD-2026-95206","GHSA-j75v-5pm7-3cg8","ROOT-OS-DEBIAN-12-CVE-2026-67693","ROOT-OS-DEBIAN-13-CVE-2026-67693","UBUNTU-CVE-2026-67693"],"status":"disputed","title":"An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to...","description":"GnuTLS v3.8.13 does not reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU). NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00167,"percentile":0.05965,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-367"],"published":"2026-10-08T00:00:00Z","modified":"2026-11-04T04:52:04Z","fixes":[{"ecosystem":"Root:Debian:12","package":"gnutls28","fixed_in":["3.7.9-2+deb12u7.aikido.5"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-gnutls28","fixed_in":["3.7.9-2+deb12u7.aikido.5"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"gnutls28","fixed_in":["3.8.9-3+deb13u4.aikido.3"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-gnutls28","fixed_in":["3.8.9-3+deb13u4.aikido.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.8.13-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.9-2","3.7.9-2+deb12u1","3.7.9-2+deb12u2","3.7.9-2+deb12u3","3.7.9-2+deb12u4","3.7.9-2+deb12u5","3.7.9-2+deb12u6","3.7.9-2+deb12u7","3.7.9-2+loong64","3.8.0+git20230413-1","3.8.0+git20230529-1","3.8.0+git20230713-1","3.8.1-1","3.8.1-2","3.8.1-3","3.8.1-4","3.8.10-1","3.8.10-2","3.8.10-3","3.8.11-1","3.8.11-2","3.8.11-3","3.8.12-1","3.8.12-2","3.8.12-3","3.8.12-4","3.8.13-1","3.8.2-1","3.8.3-1","3.8.3-1.1","3.8.3-1.1~exp1","3.8.4-1","3.8.4-2","3.8.5-1","3.8.5-2","3.8.5-3","3.8.5-4","3.8.6-1","3.8.6-2","3.8.7.1-1","3.8.8-1","3.8.8-2","3.8.9-1","3.8.9-2","3.8.9-3"]},{"source":"osv","ecosystem":"Debian:13","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.10-1","3.8.10-2","3.8.10-3","3.8.11-1","3.8.11-2","3.8.11-3","3.8.12-1","3.8.12-2","3.8.12-3","3.8.12-4","3.8.13-1","3.8.9-3","3.8.9-3+deb13u1","3.8.9-3+deb13u2","3.8.9-3+deb13u3","3.8.9-3+deb13u4"]},{"source":"osv","ecosystem":"Debian:14","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.10-1","3.8.10-2","3.8.10-3","3.8.11-1","3.8.11-2","3.8.11-3","3.8.12-1","3.8.12-2","3.8.12-3","3.8.12-4","3.8.13-1","3.8.9-3"]},{"source":"osv","ecosystem":"Root:Debian:12","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.9-2+deb12u7.aikido.5"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.9-2+deb12u7.aikido.5"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.9-3+deb13u4.aikido.3"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.9-3+deb13u4.aikido.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"gnutls26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.23-1ubuntu4","2.12.23-1ubuntu5","2.12.23-12ubuntu1","2.12.23-12ubuntu2","2.12.23-12ubuntu2.1","2.12.23-12ubuntu2.2","2.12.23-12ubuntu2.3","2.12.23-12ubuntu2.4","2.12.23-12ubuntu2.5","2.12.23-12ubuntu2.6","2.12.23-12ubuntu2.7","2.12.23-12ubuntu2.8","2.12.23-12ubuntu2.10+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.15-5ubuntu2","3.3.18-1ubuntu1","3.3.20-1ubuntu1","3.4.9-2ubuntu1","3.4.10-4ubuntu1","3.4.10-4ubuntu1.1","3.4.10-4ubuntu1.2","3.4.10-4ubuntu1.3","3.4.10-4ubuntu1.4","3.4.10-4ubuntu1.5","3.4.10-4ubuntu1.6","3.4.10-4ubuntu1.7","3.4.10-4ubuntu1.8","3.4.10-4ubuntu1.9","3.4.10-4ubuntu1.9+esm1","3.4.10-4ubuntu1.9+esm2","3.4.10-4ubuntu1.9+esm3","3.4.10-4ubuntu1.9+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.8-6ubuntu3","3.5.17-1ubuntu1","3.5.17-1ubuntu3","3.5.18-1ubuntu1","3.5.18-1ubuntu1.1","3.5.18-1ubuntu1.2","3.5.18-1ubuntu1.3","3.5.18-1ubuntu1.4","3.5.18-1ubuntu1.5","3.5.18-1ubuntu1.6","3.5.18-1ubuntu1.6+esm1","3.5.18-1ubuntu1.6+esm2","3.5.18-1ubuntu1.6+esm3","3.5.18-1ubuntu1.6+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.9-5ubuntu1","3.6.9-5ubuntu2","3.6.10-5","3.6.11.1-2","3.6.11.1-2ubuntu2","3.6.13-2ubuntu1","3.6.13-2ubuntu1.1","3.6.13-2ubuntu1.2","3.6.13-2ubuntu1.3","3.6.13-2ubuntu1.6","3.6.13-2ubuntu1.7","3.6.13-2ubuntu1.8","3.6.13-2ubuntu1.9","3.6.13-2ubuntu1.10","3.6.13-2ubuntu1.11","3.6.13-2ubuntu1.12","3.6.13-2ubuntu1.12+esm1","3.6.13-2ubuntu1.12+esm2","3.6.13-2ubuntu1.12+esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.1-5ubuntu1","3.7.2-2ubuntu1","3.7.2-4ubuntu1","3.7.2-5ubuntu1","3.7.3-4ubuntu1","3.7.3-4ubuntu1.1","3.7.3-4ubuntu1.2","3.7.3-4ubuntu1.3","3.7.3-4ubuntu1.4","3.7.3-4ubuntu1.5","3.7.3-4ubuntu1.6","3.7.3-4ubuntu1.7","3.7.3-4ubuntu1.8","3.7.3-4ubuntu1.9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.3-4ubuntu1.2+Fips1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.3-4ubuntu1.2+Fips1.1","3.7.3-4ubuntu1.3+Fips1.1","3.7.3-4ubuntu1.4+Fips1","3.7.3-4ubuntu1.5+Fips1","3.7.3-4ubuntu1.6+Fips1","3.7.3-4ubuntu1.7+Fips1","3.7.3-4ubuntu1.7+Fips1.1","3.7.3-4ubuntu1.8+Fips1.1","3.7.3-4ubuntu1.9+Fips1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.1-4ubuntu1","3.8.1-4ubuntu6","3.8.1-4ubuntu7","3.8.3-1ubuntu1","3.8.3-1.1ubuntu2","3.8.3-1.1ubuntu3","3.8.3-1.1ubuntu3.1","3.8.3-1.1ubuntu3.2","3.8.3-1.1ubuntu3.3","3.8.3-1.1ubuntu3.4","3.8.3-1.1ubuntu3.5","3.8.3-1.1ubuntu3.6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.3-1.1ubuntu3.1+Fips1","3.8.3-1.1ubuntu3.4+Fips1","3.8.3-1.1ubuntu3.4+Fips1.1","3.8.3-1.1ubuntu3.5+Fips1.1","3.8.3-1.1ubuntu3.6+Fips1.2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.12-2ubuntu1","3.8.12-2ubuntu1.1","3.8.13-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.9-3ubuntu2","3.8.10-3ubuntu1","3.8.12-2ubuntu1","3.8.12-2ubuntu1.1"]}],"references":[{"url":"https://gitlab.com/gnutls/gnutls/-/blob/3.8.13/lib/x509/verify.c#L1119-1178","tags":["report"]},{"url":"https://gist.github.com/lkloliver/6fbfc191bc6163942c8017551ac3f238","tags":["report"]},{"url":"https://gitlab.com/gnutls/gnutls/-/work_items/1642"},{"url":"https://gitlab.com/gnutls/gnutls/-/work_items/1965"},{"url":"https://gitlab.com/gnutls/gnutls/-/blob/e2169a87c7fb91935c2845088204b102baed4c5f/SECURITY.md"},{"url":"https://github.com/lkloliver/poc/tree/main/CVE-2026-67693"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67693","tags":["web"]},{"url":"http://gnutls.com"},{"url":"https://github.com/advisories/GHSA-j75v-5pm7-3cg8"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-67693","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-67693","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-67693","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67693","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-67693","description":"GnuTLS v3.8.13 does not reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU). NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy.","status":"disputed","published":"2026-10-08T00:00:00Z","modified":"2026-11-04T04:52:04.59Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-367"],"updated_at":"2026-11-04T05:21:48.223566Z"}],"euvd":[{"id":"EUVD-2026-95206","description":"GnuTLS v3.8.13 does not reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU). NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy.","status":"published","published":"2026-10-08T00:00:00Z","modified":"2026-11-04T04:52:04Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-04T07:00:57.76849Z"}],"ghsa":[{"id":"GHSA-j75v-5pm7-3cg8","title":"An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to...","description":"An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU)","status":"published","published":"2026-10-08T21:33:25Z","modified":"2026-11-04T06:33:59Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-367"],"updated_at":"2026-11-04T06:56:59.793788Z"}],"nvd":[{"id":"CVE-2026-67693","description":"GnuTLS v3.8.13 does not reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU). NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy.","status":"disputed","published":"2026-10-08T19:18:41.28Z","modified":"2026-11-04T05:19:00.233Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-367"],"updated_at":"2026-11-04T06:53:24.125861Z"}],"osv":[{"id":"BELL-CVE-2026-67693","title":"CVE-2026-67693 does not affect BellSoft software","status":"withdrawn","published":"2026-10-09T06:05:29.93095Z","modified":"2026-10-28T07:15:04.690939008Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:28:25.231222Z"},{"id":"DEBIAN-CVE-2026-67693","description":"GnuTLS v3.8.13 does not reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU). NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy.","status":"published","published":"2026-10-08T19:18:41.28Z","modified":"2026-11-05T05:00:28.659722955Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-05T07:10:31.343344Z"},{"id":"UBUNTU-CVE-2026-67693","description":"GnuTLS v3.8.13 does not reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU). NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy.","status":"published","published":"2026-10-08T19:18:00Z","modified":"2026-11-05T11:46:34.071282118Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-05T13:30:15.321876Z"},{"id":"AZL-107448","title":"CVE-2026-67693 affecting package gnutls 3.8.13-1","description":"GnuTLS v3.8.13 does not reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU). NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy.","status":"published","published":"2026-10-08T19:18:41Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-67693","title":"CVE-2026-67693 in gnutls28 - Patched by Root","description":"Root has patched CVE-2026-67693 in the gnutls28 package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-10-16T10:20:44Z","modified":"2026-10-16T11:15:04.296931578Z","updated_at":"2026-11-02T15:53:32.570806Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-67693","title":"CVE-2026-67693 in gnutls28 - Patched by Root","description":"Root has patched CVE-2026-67693 in the gnutls28 package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-10-16T10:52:29Z","modified":"2026-10-16T11:15:04.233275009Z","updated_at":"2026-11-02T15:53:33.681527Z"}]}}