{"id":"CVE-2026-88647","aliases":["AZL-107445","BELL-CVE-2026-88647","DEBIAN-CVE-2026-88647","EUVD-2026-95113","GHSA-2j2x-fffq-ff4q","ROOT-OS-DEBIAN-12-CVE-2026-88647","ROOT-OS-DEBIAN-13-CVE-2026-88647","UBUNTU-CVE-2026-88647"],"status":"disputed","title":"A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name...","description":"GnuTLS v3.8.13 can perhaps unexpectedly trust a certificate on the basis of Common Name when Subject Alternative Name has an SRV otherName (1.3.6.1.5.5.7.8.7) whose value is an OCTET STRING. NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.0024,"percentile":0.15202,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-297"],"published":"2026-10-08T00:00:00Z","modified":"2026-11-04T04:52:45Z","fixes":[{"ecosystem":"Root:Debian:12","package":"gnutls28","fixed_in":["3.7.9-2+deb12u7.aikido.5"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-gnutls28","fixed_in":["3.7.9-2+deb12u7.aikido.5"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"gnutls28","fixed_in":["3.8.9-3+deb13u4.aikido.3"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-gnutls28","fixed_in":["3.8.9-3+deb13u4.aikido.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.8.13-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.9-2","3.7.9-2+deb12u1","3.7.9-2+deb12u2","3.7.9-2+deb12u3","3.7.9-2+deb12u4","3.7.9-2+deb12u5","3.7.9-2+deb12u6","3.7.9-2+deb12u7","3.7.9-2+loong64","3.8.0+git20230413-1","3.8.0+git20230529-1","3.8.0+git20230713-1","3.8.1-1","3.8.1-2","3.8.1-3","3.8.1-4","3.8.10-1","3.8.10-2","3.8.10-3","3.8.11-1","3.8.11-2","3.8.11-3","3.8.12-1","3.8.12-2","3.8.12-3","3.8.12-4","3.8.13-1","3.8.2-1","3.8.3-1","3.8.3-1.1","3.8.3-1.1~exp1","3.8.4-1","3.8.4-2","3.8.5-1","3.8.5-2","3.8.5-3","3.8.5-4","3.8.6-1","3.8.6-2","3.8.7.1-1","3.8.8-1","3.8.8-2","3.8.9-1","3.8.9-2","3.8.9-3"]},{"source":"osv","ecosystem":"Debian:13","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.10-1","3.8.10-2","3.8.10-3","3.8.11-1","3.8.11-2","3.8.11-3","3.8.12-1","3.8.12-2","3.8.12-3","3.8.12-4","3.8.13-1","3.8.9-3","3.8.9-3+deb13u1","3.8.9-3+deb13u2","3.8.9-3+deb13u3","3.8.9-3+deb13u4"]},{"source":"osv","ecosystem":"Debian:14","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.10-1","3.8.10-2","3.8.10-3","3.8.11-1","3.8.11-2","3.8.11-3","3.8.12-1","3.8.12-2","3.8.12-3","3.8.12-4","3.8.13-1","3.8.9-3"]},{"source":"osv","ecosystem":"Root:Debian:12","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.9-2+deb12u7.aikido.5"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.9-2+deb12u7.aikido.5"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.9-3+deb13u4.aikido.3"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.9-3+deb13u4.aikido.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"gnutls26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.23-1ubuntu4","2.12.23-1ubuntu5","2.12.23-12ubuntu1","2.12.23-12ubuntu2","2.12.23-12ubuntu2.1","2.12.23-12ubuntu2.2","2.12.23-12ubuntu2.3","2.12.23-12ubuntu2.4","2.12.23-12ubuntu2.5","2.12.23-12ubuntu2.6","2.12.23-12ubuntu2.7","2.12.23-12ubuntu2.8","2.12.23-12ubuntu2.10+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.15-5ubuntu2","3.3.18-1ubuntu1","3.3.20-1ubuntu1","3.4.9-2ubuntu1","3.4.10-4ubuntu1","3.4.10-4ubuntu1.1","3.4.10-4ubuntu1.2","3.4.10-4ubuntu1.3","3.4.10-4ubuntu1.4","3.4.10-4ubuntu1.5","3.4.10-4ubuntu1.6","3.4.10-4ubuntu1.7","3.4.10-4ubuntu1.8","3.4.10-4ubuntu1.9","3.4.10-4ubuntu1.9+esm1","3.4.10-4ubuntu1.9+esm2","3.4.10-4ubuntu1.9+esm3","3.4.10-4ubuntu1.9+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.8-6ubuntu3","3.5.17-1ubuntu1","3.5.17-1ubuntu3","3.5.18-1ubuntu1","3.5.18-1ubuntu1.1","3.5.18-1ubuntu1.2","3.5.18-1ubuntu1.3","3.5.18-1ubuntu1.4","3.5.18-1ubuntu1.5","3.5.18-1ubuntu1.6","3.5.18-1ubuntu1.6+esm1","3.5.18-1ubuntu1.6+esm2","3.5.18-1ubuntu1.6+esm3","3.5.18-1ubuntu1.6+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.9-5ubuntu1","3.6.9-5ubuntu2","3.6.10-5","3.6.11.1-2","3.6.11.1-2ubuntu2","3.6.13-2ubuntu1","3.6.13-2ubuntu1.1","3.6.13-2ubuntu1.2","3.6.13-2ubuntu1.3","3.6.13-2ubuntu1.6","3.6.13-2ubuntu1.7","3.6.13-2ubuntu1.8","3.6.13-2ubuntu1.9","3.6.13-2ubuntu1.10","3.6.13-2ubuntu1.11","3.6.13-2ubuntu1.12","3.6.13-2ubuntu1.12+esm1","3.6.13-2ubuntu1.12+esm2","3.6.13-2ubuntu1.12+esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.1-5ubuntu1","3.7.2-2ubuntu1","3.7.2-4ubuntu1","3.7.2-5ubuntu1","3.7.3-4ubuntu1","3.7.3-4ubuntu1.1","3.7.3-4ubuntu1.2","3.7.3-4ubuntu1.3","3.7.3-4ubuntu1.4","3.7.3-4ubuntu1.5","3.7.3-4ubuntu1.6","3.7.3-4ubuntu1.7","3.7.3-4ubuntu1.8","3.7.3-4ubuntu1.9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.3-4ubuntu1.2+Fips1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.3-4ubuntu1.2+Fips1.1","3.7.3-4ubuntu1.3+Fips1.1","3.7.3-4ubuntu1.4+Fips1","3.7.3-4ubuntu1.5+Fips1","3.7.3-4ubuntu1.6+Fips1","3.7.3-4ubuntu1.7+Fips1","3.7.3-4ubuntu1.7+Fips1.1","3.7.3-4ubuntu1.8+Fips1.1","3.7.3-4ubuntu1.9+Fips1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.1-4ubuntu1","3.8.1-4ubuntu6","3.8.1-4ubuntu7","3.8.3-1ubuntu1","3.8.3-1.1ubuntu2","3.8.3-1.1ubuntu3","3.8.3-1.1ubuntu3.1","3.8.3-1.1ubuntu3.2","3.8.3-1.1ubuntu3.3","3.8.3-1.1ubuntu3.4","3.8.3-1.1ubuntu3.5","3.8.3-1.1ubuntu3.6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.3-1.1ubuntu3.1+Fips1","3.8.3-1.1ubuntu3.4+Fips1","3.8.3-1.1ubuntu3.4+Fips1.1","3.8.3-1.1ubuntu3.5+Fips1.1","3.8.3-1.1ubuntu3.6+Fips1.2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.12-2ubuntu1","3.8.12-2ubuntu1.1","3.8.13-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.9-3ubuntu2","3.8.10-3ubuntu1","3.8.12-2ubuntu1","3.8.12-2ubuntu1.1"]}],"references":[{"url":"https://gitlab.com/gnutls/gnutls/-/issues/1802","tags":["report"]},{"url":"https://gist.github.com/lkloliver/f98ec3de1a871fdfc02b70b8b9ba7642","tags":["report"]},{"url":"https://gitlab.com/gnutls/gnutls/-/work_items/1965"},{"url":"https://gitlab.com/gnutls/gnutls/-/blob/e2169a87c7fb91935c2845088204b102baed4c5f/SECURITY.md"},{"url":"https://github.com/lkloliver/poc/tree/main/CVE-2026-88647"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88647","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2j2x-fffq-ff4q"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-88647","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-88647","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-88647","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-88647","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-88647","description":"GnuTLS v3.8.13 can perhaps unexpectedly trust a certificate on the basis of Common Name when Subject Alternative Name has an SRV otherName (1.3.6.1.5.5.7.8.7) whose value is an OCTET STRING. NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy.","status":"disputed","published":"2026-10-08T00:00:00Z","modified":"2026-11-04T04:52:45.613Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-297"],"updated_at":"2026-11-04T05:21:48.223566Z"}],"euvd":[{"id":"EUVD-2026-95113","description":"GnuTLS v3.8.13 can perhaps unexpectedly trust a certificate on the basis of Common Name when Subject Alternative Name has an SRV otherName (1.3.6.1.5.5.7.8.7) whose value is an OCTET STRING. NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy.","status":"published","published":"2026-10-08T00:00:00Z","modified":"2026-11-04T04:52:45Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-04T07:00:57.274021Z"}],"ghsa":[{"id":"GHSA-2j2x-fffq-ff4q","title":"A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name...","description":"A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certificate.","status":"published","published":"2026-10-08T18:32:29Z","modified":"2026-11-04T06:32:52Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-297"],"updated_at":"2026-11-04T06:56:58.885599Z"}],"nvd":[{"id":"CVE-2026-88647","description":"GnuTLS v3.8.13 can perhaps unexpectedly trust a certificate on the basis of Common Name when Subject Alternative Name has an SRV otherName (1.3.6.1.5.5.7.8.7) whose value is an OCTET STRING. NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy.","status":"disputed","published":"2026-10-08T17:17:17.783Z","modified":"2026-11-04T05:19:04.98Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-297"],"updated_at":"2026-11-04T06:53:24.125861Z"}],"osv":[{"id":"BELL-CVE-2026-88647","title":"CVE-2026-88647 does not affect BellSoft software","status":"withdrawn","published":"2026-10-09T06:05:30.142085Z","modified":"2026-10-28T07:15:07.646481555Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:26.630331Z"},{"id":"DEBIAN-CVE-2026-88647","description":"GnuTLS v3.8.13 can perhaps unexpectedly trust a certificate on the basis of Common Name when Subject Alternative Name has an SRV otherName (1.3.6.1.5.5.7.8.7) whose value is an OCTET STRING. NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy.","status":"published","published":"2026-10-08T17:17:17.783Z","modified":"2026-11-05T05:00:28.685838382Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-05T07:10:31.343344Z"},{"id":"UBUNTU-CVE-2026-88647","description":"GnuTLS v3.8.13 can perhaps unexpectedly trust a certificate on the basis of Common Name when Subject Alternative Name has an SRV otherName (1.3.6.1.5.5.7.8.7) whose value is an OCTET STRING. NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy.","status":"published","published":"2026-10-08T17:17:00Z","modified":"2026-11-05T11:47:36.663209531Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"AZL-107445","title":"CVE-2026-88647 affecting package gnutls 3.8.13-1","description":"GnuTLS v3.8.13 can perhaps unexpectedly trust a certificate on the basis of Common Name when Subject Alternative Name has an SRV otherName (1.3.6.1.5.5.7.8.7) whose value is an OCTET STRING. NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy.","status":"published","published":"2026-10-08T17:17:17Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-88647","title":"CVE-2026-88647 in gnutls28 - Patched by Root","description":"Root has patched CVE-2026-88647 in the gnutls28 package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-10-16T10:20:44Z","modified":"2026-10-16T11:15:12.151907681Z","updated_at":"2026-11-02T15:53:32.570806Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-88647","title":"CVE-2026-88647 in gnutls28 - Patched by Root","description":"Root has patched CVE-2026-88647 in the gnutls28 package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-10-16T10:52:29Z","modified":"2026-10-16T11:15:11.849141671Z","updated_at":"2026-11-02T15:53:33.681527Z"}]}}