Is CVE-2026-95184 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-95184 being exploited in the wild.

How severe is CVE-2026-95184?

High severity, with a CVSS score of 7.5, published 8 October 2026.

Is there a fix for CVE-2026-95184?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-95184 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-95184?

Check whether you run GnuTLS Project GnuTLS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-95184: GnuTLS certificate validation bypass in name constraints

CVE-2026-95184 · Severity: high · CVSS 7.5 · Published 2026-10-08

GnuTLS is a widely used cryptographic library that secures communications for many applications and services. A flaw in version 3.8.13 allows attackers controlling a subordinate certificate authority to issue certificates for domains or organizations outside their permitted scope, which GnuTLS incorrectly accepts. This defeats PKI cross-domain restrictions and enables attackers to impersonate legitimate organizations or domains.

Vendors: GnuTLS Project.

Quick answers

Is CVE-2026-95184 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-95184 being exploited in the wild.
How severe is CVE-2026-95184?: High severity, with a CVSS score of 7.5, published 8 October 2026.
Which products and versions are affected?: GnuTLS Project GnuTLS 3.8.13.
Is there a fix for CVE-2026-95184?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-95184 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-95184?: Check whether you run GnuTLS Project GnuTLS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

GnuTLS 3.8.13 fails to enforce RFC 5280 permitted subtree constraints for directoryName and URI name forms in certificate path validation. The vulnerable check_unsupported_constraint() function iterates only the excluded list, never consulting the permitted list for DN or URI names, allowing a subordinate CA to issue end-entity certificates outside its constrained namespace. An attacker with control of a constrained subordinate CA can issue certificates that bypass these restrictions and be accepted by GnuTLS clients.

Affected products

GnuTLS Project GnuTLS 3.8.13

Timeline

2026-10-08: disclosed: CVE-2026-95184 published
2026-04-29: other: GnuTLS 3.8.13 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.