# CVE-2026-1584: GnuTLS NULL pointer dereference in PSK binder verification

Source: https://junglewise.ai/threats/cve-2026-1584-gnutls-null-pointer-dereference-in-psk-binder-verification  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-09. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-1584 · Severity: high · CVSS 7.5 · Published 2026-04-09

GnuTLS is a widely used security library that enables secure communications over the internet. A flaw in how it handles specific connection requests allows a remote, unauthenticated attacker to crash servers using this library. This results in a denial-of-service (DoS) condition, potentially disrupting business operations and service availability.

Technologies: [Gnutls](https://junglewise.ai/threats/technologies/gnutls), [Redhat Hardened Images](https://junglewise.ai/threats/technologies/hardened-images). Vendors: [Gnu](https://junglewise.ai/threats/vendors/gnu), [Redhat](https://junglewise.ai/threats/vendors/redhat).

## Quick answers

**Is CVE-2026-1584 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-1584 being exploited in the wild.

**How severe is CVE-2026-1584?** High severity, with a CVSS score of 7.5, published 9 April 2026.

**Which products and versions are affected?** GnuTLS GnuTLS 3.8.12-1.1.hum1 and earlier; Red Hat Red Hat Hardened Images gnutls-3.8.12-1.1.hum1.

**Is there a fix for CVE-2026-1584?** A patch was published on 2026-04-10: Red Hat released security advisory RHSA-2026:7477 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-1584 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-1584?** Check whether you run Gnutls or Redhat Hardened Images. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A NULL pointer dereference exists in GnuTLS within the PSK (Pre-Shared Key) binder verification logic. When a server receives a ClientHello message referencing a previously issued session ticket, the '_gnutls_get_cred' function may return a NULL pointer for PSK credentials. If the attacker provides an invalid PSK binder value, the server attempts to dereference this NULL pointer in 'server_recv_params' while attempting to access 'pskcred->binder_algo'. This vulnerability can be exploited by a remote, unauthenticated attacker to crash the server process. Red Hat has released patches for affected Hardened Images (RHSA-2026:7477).

## Affected products

- GnuTLS GnuTLS 3.8.12-1.1.hum1 and earlier
- Red Hat Red Hat Hardened Images gnutls-3.8.12-1.1.hum1

## Timeline

- 2026-01-29: disclosed: Reported via Red Hat Bugzilla
- 2026-04-09: advisory: NVD publication date
- 2026-04-10: patched: Red Hat released security advisory RHSA-2026:7477

## References

- [https://catalog.redhat.com/software/containers/](https://catalog.redhat.com/software/containers/)
- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/errata/RHSA-2026:7477](https://access.redhat.com/errata/RHSA-2026:7477)
- [https://access.redhat.com/security/cve/CVE-2026-1584](https://access.redhat.com/security/cve/CVE-2026-1584)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2435258](https://bugzilla.redhat.com/show_bug.cgi?id=2435258)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1584.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1584.json)

## Related threats

- [GnuTLS hostname verification bypass via Common Name fallback](https://junglewise.ai/threats/cve-2026-88647-a-hostname-verification-bypass-in-gnutls-v3-8-13-allows-attackers)
- [A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output…](https://junglewise.ai/threats/cve-2026-71227-a-flaw-was-found-in-libkcapi-a-local-attacker-can-influence-an)
- [Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all…](https://junglewise.ai/threats/cve-2026-71226-memory-corruption-via-uncanceled-aio-requests-on-error-libkcapi-s)
- [A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs (over 64 KiB) in…](https://junglewise.ai/threats/cve-2026-71225-a-flaw-was-found-in-libkcapi-when-performing-one-shot-symmetric)
- [GnuTLS integer underflow in DTLS handshake parsing](https://junglewise.ai/threats/cve-2026-33845-gnutls-integer-underflow-in-dtls-handshake-parsing)