Executive brief
A security flaw was identified in GnuTLS, a widely used software library that handles secure internet connections (SSL/TLS). The vulnerability allows an attacker to bypass security checks that verify if a digital certificate is authorized to represent a specific domain. This could allow a malicious actor to impersonate legitimate websites or intercept encrypted communications, potentially leading to the theft of sensitive data.
Technical details
A vulnerability exists in GnuTLS due to improper certificate validation (CWE-295) specifically related to X.509 name constraint handling. The flaw occurs when permitted name constraints are incorrectly ignored if previous Certificate Authorities (CAs) in the chain only specified excluded name constraints. A remote attacker can exploit this logic error to present a certificate that should be rejected, effectively bypassing critical name constraint checks. This can lead to the acceptance of invalid certificates, enabling spoofing or man-in-the-middle (MitM) attacks. The issue has been addressed in Red Hat Enterprise Linux versions 8, 9, and 10 via security updates such as RHSA-2026:20611.
Affected products
- GnuTLS gnutls 3.6.x, 3.8.x
- Red Hat Enterprise Linux 8 8.10
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux 10
Timeline
- 2026-05-02: patched: Initial Red Hat Hardened Images update released
- 2026-05-06: disclosed: Bug reported to Red Hat Bugzilla
- 2026-05-07: advisory: NVD published the CVE record
- 2026-05-26: patched: General availability of patches for RHEL 8, 9, and 10