CVE-2026-67693
UnknownSummary
An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU).
Risk Assessment
An attacker could exploit this vulnerability to obtain sensitive information, potentially leading to data security breaches.
Recommendation
Update GnuTLS to a version that includes a fix. Additionally, configure systems to reject certificates with inconsistent KU/EKU values.
Other vulnerabilities in GnuTLS
See all- CVE-2026-95209High
An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of Service (DoS).
- CVE-2026-88648Unknown
Incomplete X.509 implementation in GnuTLS v3.8.13 allows attackers controlling a subordinate Certificate Authority to bypass cross-domain PKI restrictions and issue unauthorized certificates.
- CVE-2026-95184High
Improper certificate validation in gnutls v3.8.13 causes the application to reject legitimate certificates for valid users, leading to a Denial of Service (DoS).
- CVE-2026-88647Unknown
A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certificate.
- CVE-2016-4456High
The 'GNUTLS_KEYLOGFILE' environment variable in gnutls 3.4.12 allows remote attackers to overwrite and corrupt arbitrary files in the filesystem.
- CVE-2017-7507High
GnuTLS version 3.5.12 and earlier is vulnerable to a NULL pointer dereference while decoding a status response TLS extension with valid contents. This could lead to a crash of the GnuTLS server application.
- CVE-2017-7869High
GnuTLS before February 20, 2017, has an out-of-bounds write caused by an integer overflow and heap-based buffer overflow related to the cdk_pkt_read function in opencdk/read-packet.c. This issue is a subset of the vendor's GNUTLS-SA-2017-3 report and is fixed in version 3.5.10.
- CVE-2017-5335High
The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service (out-of-memory error and crash) via a crafted OpenPGP certificate.
- CVE-2016-7444High
The gnutls_ocsp_resp_check_crt function in GnuTLS before 3.4.15 and 3.5.x before 3.5.4 does not verify the serial length of an OCSP response, which might allow remote attackers to bypass an intended certificate validation mechanism.
- CVE-2015-3308High
A double free vulnerability in lib/x509/x509_ext.c in GnuTLS before version 3.3.14 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted CRL distribution point.
Original NVD description (English source)
An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU)
Vulnerability data from NVD (NIST) · CISA KEV · EPSS