CVE-2026-3833

CVE-2026-3833 · Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within `excludedSubtrees` or `permittedSubtrees`. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.

CVSS 6.5 · Medium · EPSS 0.6% · Fix available

Published

2026-04-30T17:37:05.818Z

Updated

2026-10-14T19:24:09.620Z

Stack: system

Check your server →