Is CVE-2026-88648 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-88648 being exploited in the wild.

How severe is CVE-2026-88648?

Informational severity, published 8 October 2026.

Is there a fix for CVE-2026-88648?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-88648 attacked?

It is attacked over the network.

Am I affected by CVE-2026-88648?

Check whether you run GnuTLS Project GnuTLS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-88648: GnuTLS X.509 name constraints bypass in certificate validation

CVE-2026-88648 · Severity: info · Published 2026-10-08

GnuTLS is a widely-used cryptographic library that validates digital certificates in many applications. This vulnerability allows an attacker who controls a subordinate certificate authority to issue certificates outside permitted domains, potentially impersonating trusted entities. The flaw also breaks legitimate certificates in some PKI configurations, causing denial of service.

Vendors: GnuTLS Project.

Quick answers

Is CVE-2026-88648 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-88648 being exploited in the wild.
How severe is CVE-2026-88648?: Informational severity, published 8 October 2026.
Which products and versions are affected?: GnuTLS Project GnuTLS 3.8.13.
Is there a fix for CVE-2026-88648?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-88648 attacked?: It is attacked over the network.
Am I affected by CVE-2026-88648?: Check whether you run GnuTLS Project GnuTLS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

GnuTLS 3.8.13 implements incomplete name-constraints enforcement per RFC 5280: permitted directoryName constraints are ignored, excluded msUPN and SRV otherName constraints are never checked, and excluded directoryName constraints incorrectly reject all certificates. The root cause lies in check_unsupported_constraint() iterating only the excluded list and lacking proper DN matching logic, combined with absent enforcement calls for msUPN/SRV otherName types. An attacker controlling a subordinate CA under a constrained root can issue certificates outside the permitted namespace or cause denial of service for legitimate certificates using DN exclusions.

Affected products

GnuTLS Project GnuTLS 3.8.13

Timeline

2026-10-08: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.