CVE-2026-1584
CVE-2026-1584 · Gnutls: gnutls: remote denial of service via crafted clienthello with invalid psk binder
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A flaw was found in gnutls. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted ClientHello message with an invalid Pre-Shared Key (PSK) binder value during the TLS handshake. This can lead to a NULL pointer dereference, causing the server to crash and resulting in a remote Denial of Service (DoS) condition.
CVSS 7.5 · High · EPSS 1.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
red hat hardened images
- Versions
- ≥ 3.8.12-1.1.hum1: Not affected (rpm)
No fix published
red hat enterprise linux 10
No fix published
red hat enterprise linux 6
No fix published
red hat enterprise linux 7
No fix published
red hat enterprise linux 8
No fix published
red hat enterprise linux 9
No fix published
red hat openshift container platform 4
No fix published
gnutls28 Debian:14
- Versions
- 3.8.10-1
- 3.8.10-2
- 3.8.10-3
- 3.8.11-1
- 3.8.11-2
- 3.8.11-3
- 3.8.9-3
- Affected ranges
- ECOSYSTEM: < 3.8.12-1
Update to 3.8.12-1