Executive brief
GnuTLS is a widely used security library that helps applications establish secure, encrypted connections. A flaw in how it validates digital certificates could allow an attacker to impersonate a legitimate website or service. This could lead to users unknowingly connecting to a malicious server, potentially resulting in the theft of sensitive login credentials or private data.
Technical details
A vulnerability exists in GnuTLS (CWE-295) due to improper handling of Subject Alternative Names (SANs). When a certificate contains Uniform Resource Identifier (URI) or Service (SRV) SANs, the validation logic incorrectly falls back to checking the DNS hostname against the Common Name (CN) field. This logic failure bypasses the standard requirement that SANs, if present, must be the sole source for identity verification. A remote attacker can exploit this by presenting a crafted certificate to a client application using GnuTLS, potentially allowing for service spoofing or man-in-the-middle (MitM) attacks. The fix involves suppressing the CN fallback mechanism when URI or SRV SANs are detected.
Affected products
- GnuTLS gnutls
Timeline
- 2026-05-06: disclosed: Initial report in Red Hat Bugzilla
- 2026-05-26: advisory: NVD publication date