{"id":"CVE-2026-95210","aliases":["AZL-107442","BELL-CVE-2026-95210","DEBIAN-CVE-2026-95210","EUVD-2026-95139","GHSA-9mfx-g534-q3pc","ROOT-OS-DEBIAN-12-CVE-2026-95210","ROOT-OS-DEBIAN-13-CVE-2026-95210","UBUNTU-CVE-2026-95210"],"status":"disputed","title":"Improper certificate validation in gnutls v3.8.13 causes the application to accept certificates...","description":"GnuTLS v3.8.13 does not reject a critical keyUsage extension when it cannot be processed, such as when extnValue is an ASN.1 NULL (05 00) instead of a BIT STRING. NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy.","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.002,"percentile":0.09993,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2026-10-08T00:00:00Z","modified":"2026-11-04T04:54:27Z","fixes":[{"ecosystem":"Root:Debian:12","package":"gnutls28","fixed_in":["3.7.9-2+deb12u7.aikido.5"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-gnutls28","fixed_in":["3.7.9-2+deb12u7.aikido.5"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"gnutls28","fixed_in":["3.8.9-3+deb13u4.aikido.3"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-gnutls28","fixed_in":["3.8.9-3+deb13u4.aikido.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.8.13-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.8-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.8-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.0-r3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.9-2","3.7.9-2+deb12u1","3.7.9-2+deb12u2","3.7.9-2+deb12u3","3.7.9-2+deb12u4","3.7.9-2+deb12u5","3.7.9-2+deb12u6","3.7.9-2+deb12u7","3.7.9-2+loong64","3.8.0+git20230413-1","3.8.0+git20230529-1","3.8.0+git20230713-1","3.8.1-1","3.8.1-2","3.8.1-3","3.8.1-4","3.8.10-1","3.8.10-2","3.8.10-3","3.8.11-1","3.8.11-2","3.8.11-3","3.8.12-1","3.8.12-2","3.8.12-3","3.8.12-4","3.8.13-1","3.8.2-1","3.8.3-1","3.8.3-1.1","3.8.3-1.1~exp1","3.8.4-1","3.8.4-2","3.8.5-1","3.8.5-2","3.8.5-3","3.8.5-4","3.8.6-1","3.8.6-2","3.8.7.1-1","3.8.8-1","3.8.8-2","3.8.9-1","3.8.9-2","3.8.9-3"]},{"source":"osv","ecosystem":"Debian:13","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.10-1","3.8.10-2","3.8.10-3","3.8.11-1","3.8.11-2","3.8.11-3","3.8.12-1","3.8.12-2","3.8.12-3","3.8.12-4","3.8.13-1","3.8.9-3","3.8.9-3+deb13u1","3.8.9-3+deb13u2","3.8.9-3+deb13u3","3.8.9-3+deb13u4"]},{"source":"osv","ecosystem":"Debian:14","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.10-1","3.8.10-2","3.8.10-3","3.8.11-1","3.8.11-2","3.8.11-3","3.8.12-1","3.8.12-2","3.8.12-3","3.8.12-4","3.8.13-1","3.8.9-3"]},{"source":"osv","ecosystem":"Root:Debian:12","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.9-2+deb12u7.aikido.5"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.9-2+deb12u7.aikido.5"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.9-3+deb13u4.aikido.3"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.9-3+deb13u4.aikido.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"gnutls26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.23-1ubuntu4","2.12.23-1ubuntu5","2.12.23-12ubuntu1","2.12.23-12ubuntu2","2.12.23-12ubuntu2.1","2.12.23-12ubuntu2.2","2.12.23-12ubuntu2.3","2.12.23-12ubuntu2.4","2.12.23-12ubuntu2.5","2.12.23-12ubuntu2.6","2.12.23-12ubuntu2.7","2.12.23-12ubuntu2.8","2.12.23-12ubuntu2.10+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.15-5ubuntu2","3.3.18-1ubuntu1","3.3.20-1ubuntu1","3.4.9-2ubuntu1","3.4.10-4ubuntu1","3.4.10-4ubuntu1.1","3.4.10-4ubuntu1.2","3.4.10-4ubuntu1.3","3.4.10-4ubuntu1.4","3.4.10-4ubuntu1.5","3.4.10-4ubuntu1.6","3.4.10-4ubuntu1.7","3.4.10-4ubuntu1.8","3.4.10-4ubuntu1.9","3.4.10-4ubuntu1.9+esm1","3.4.10-4ubuntu1.9+esm2","3.4.10-4ubuntu1.9+esm3","3.4.10-4ubuntu1.9+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.8-6ubuntu3","3.5.17-1ubuntu1","3.5.17-1ubuntu3","3.5.18-1ubuntu1","3.5.18-1ubuntu1.1","3.5.18-1ubuntu1.2","3.5.18-1ubuntu1.3","3.5.18-1ubuntu1.4","3.5.18-1ubuntu1.5","3.5.18-1ubuntu1.6","3.5.18-1ubuntu1.6+esm1","3.5.18-1ubuntu1.6+esm2","3.5.18-1ubuntu1.6+esm3","3.5.18-1ubuntu1.6+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.9-5ubuntu1","3.6.9-5ubuntu2","3.6.10-5","3.6.11.1-2","3.6.11.1-2ubuntu2","3.6.13-2ubuntu1","3.6.13-2ubuntu1.1","3.6.13-2ubuntu1.2","3.6.13-2ubuntu1.3","3.6.13-2ubuntu1.6","3.6.13-2ubuntu1.7","3.6.13-2ubuntu1.8","3.6.13-2ubuntu1.9","3.6.13-2ubuntu1.10","3.6.13-2ubuntu1.11","3.6.13-2ubuntu1.12","3.6.13-2ubuntu1.12+esm1","3.6.13-2ubuntu1.12+esm2","3.6.13-2ubuntu1.12+esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.1-5ubuntu1","3.7.2-2ubuntu1","3.7.2-4ubuntu1","3.7.2-5ubuntu1","3.7.3-4ubuntu1","3.7.3-4ubuntu1.1","3.7.3-4ubuntu1.2","3.7.3-4ubuntu1.3","3.7.3-4ubuntu1.4","3.7.3-4ubuntu1.5","3.7.3-4ubuntu1.6","3.7.3-4ubuntu1.7","3.7.3-4ubuntu1.8","3.7.3-4ubuntu1.9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.3-4ubuntu1.2+Fips1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.3-4ubuntu1.2+Fips1.1","3.7.3-4ubuntu1.3+Fips1.1","3.7.3-4ubuntu1.4+Fips1","3.7.3-4ubuntu1.5+Fips1","3.7.3-4ubuntu1.6+Fips1","3.7.3-4ubuntu1.7+Fips1","3.7.3-4ubuntu1.7+Fips1.1","3.7.3-4ubuntu1.8+Fips1.1","3.7.3-4ubuntu1.9+Fips1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.1-4ubuntu1","3.8.1-4ubuntu6","3.8.1-4ubuntu7","3.8.3-1ubuntu1","3.8.3-1.1ubuntu2","3.8.3-1.1ubuntu3","3.8.3-1.1ubuntu3.1","3.8.3-1.1ubuntu3.2","3.8.3-1.1ubuntu3.3","3.8.3-1.1ubuntu3.4","3.8.3-1.1ubuntu3.5","3.8.3-1.1ubuntu3.6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.3-1.1ubuntu3.1+Fips1","3.8.3-1.1ubuntu3.4+Fips1","3.8.3-1.1ubuntu3.4+Fips1.1","3.8.3-1.1ubuntu3.5+Fips1.1","3.8.3-1.1ubuntu3.6+Fips1.2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.12-2ubuntu1","3.8.12-2ubuntu1.1","3.8.13-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.9-3ubuntu2","3.8.10-3ubuntu1","3.8.12-2ubuntu1","3.8.12-2ubuntu1.1"]}],"references":[{"url":"http://gnutls.com","tags":["report"]},{"url":"https://gist.github.com/lkloliver/4aad23689202720c4068f43b3c6069c7","tags":["report"]},{"url":"https://gitlab.com/gnutls/gnutls/-/work_items/1965"},{"url":"https://gitlab.com/gnutls/gnutls/-/blob/e2169a87c7fb91935c2845088204b102baed4c5f/SECURITY.md"},{"url":"https://github.com/lkloliver/poc/tree/main/CVE-2026-95210","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95210","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9mfx-g534-q3pc"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-95210","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-95210","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-95210","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-95210","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-95210","description":"GnuTLS v3.8.13 does not reject a critical keyUsage extension when it cannot be processed, such as when extnValue is an ASN.1 NULL (05 00) instead of a BIT STRING. NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy.","status":"disputed","published":"2026-10-08T00:00:00Z","modified":"2026-11-04T04:54:27.527Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-295"],"updated_at":"2026-11-04T05:21:48.223566Z"}],"euvd":[{"id":"EUVD-2026-95139","description":"GnuTLS v3.8.13 does not reject a critical keyUsage extension when it cannot be processed, such as when extnValue is an ASN.1 NULL (05 00) instead of a BIT STRING. NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy.","status":"published","published":"2026-10-08T00:00:00Z","modified":"2026-11-04T04:54:27Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-04T07:00:57.274021Z"}],"ghsa":[{"id":"GHSA-9mfx-g534-q3pc","title":"Improper certificate validation in gnutls v3.8.13 causes the application to accept certificates...","description":"Improper certificate validation in gnutls v3.8.13 causes the application to accept certificates containing invalid extensions.","status":"published","published":"2026-10-08T18:32:30Z","modified":"2026-11-04T06:33:59Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-295"],"updated_at":"2026-11-04T06:56:59.793788Z"}],"nvd":[{"id":"CVE-2026-95210","description":"GnuTLS v3.8.13 does not reject a critical keyUsage extension when it cannot be processed, such as when extnValue is an ASN.1 NULL (05 00) instead of a BIT STRING. NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy.","status":"disputed","published":"2026-10-08T18:18:33.37Z","modified":"2026-11-04T05:19:06.733Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-295"],"updated_at":"2026-11-04T06:53:24.125861Z"}],"osv":[{"id":"BELL-CVE-2026-95210","status":"published","published":"2026-10-15T06:08:04.397217Z","modified":"2026-10-28T07:15:12.528095443Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:27.468539Z"},{"id":"DEBIAN-CVE-2026-95210","description":"GnuTLS v3.8.13 does not reject a critical keyUsage extension when it cannot be processed, such as when extnValue is an ASN.1 NULL (05 00) instead of a BIT STRING. NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy.","status":"published","published":"2026-10-08T18:18:33.37Z","modified":"2026-11-05T05:00:28.686760187Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-05T07:10:31.343344Z"},{"id":"UBUNTU-CVE-2026-95210","description":"GnuTLS v3.8.13 does not reject a critical keyUsage extension when it cannot be processed, such as when extnValue is an ASN.1 NULL (05 00) instead of a BIT STRING. NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy.","status":"published","published":"2026-10-08T18:18:00Z","modified":"2026-11-05T11:47:36.050173506Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"AZL-107442","title":"CVE-2026-95210 affecting package gnutls 3.8.13-1","description":"GnuTLS v3.8.13 does not reject a critical keyUsage extension when it cannot be processed, such as when extnValue is an ASN.1 NULL (05 00) instead of a BIT STRING. NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy.","status":"published","published":"2026-10-08T18:18:33Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-95210","title":"CVE-2026-95210 in gnutls28 - Patched by Root","description":"Root has patched CVE-2026-95210 in the gnutls28 package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-10-16T10:20:44Z","modified":"2026-10-16T11:15:04.983439138Z","updated_at":"2026-11-02T15:53:32.570806Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-95210","title":"CVE-2026-95210 in gnutls28 - Patched by Root","description":"Root has patched CVE-2026-95210 in the gnutls28 package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-10-16T10:52:29Z","modified":"2026-10-16T11:15:04.284413642Z","updated_at":"2026-11-02T15:53:33.943322Z"}]}}