Yüksek CVSS 7.4 PoC var

CVE-2026-3833: Gnutls: güvenlik açığı

Yayın: 30 Nisan 2026 21:16 · Güncelleme: 6 Kasım 2026 10:18

Açıklama (NVD)

A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within `excludedSubtrees` or `permittedSubtrees`. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.

Özet bilgiler

Ürün: Gnu Gnutls
CVSS v3.1: 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS: %0,57 (yüzdelik 47)
CWE: CWE-178
Yama: Yok / bilinmiyor

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
gnu-gnutls	—	—	—
redhat-hardened-images	—	—	—
redhat-openshift-container-platform	4.0	4.0	—
redhat-enterprise-linux	6.0	6.0	—
redhat-enterprise-linux	7.0	7.0	—
redhat-enterprise-linux	8.0	8.0	—
redhat-enterprise-linux	9.0	9.0	—
redhat-enterprise-linux	10.0	10.0	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları