CVE-2026-3833
Discovered by AISLEPUBLISHEDCWE-178
Description
A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within `excludedSubtrees` or `permittedSubtrees`. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.
CVSS Base Scores
CVSS v3.1(Primary)
6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected Products
| Vendor | Product | Version | Status |
|---|---|---|---|
| Red Hat | Red Hat Hardened Images | 0 | affected |
| Red Hat | Red Hat Hardened Images | 3.8.13-1.hum1 | unaffected |
| Red Hat | Red Hat Enterprise Linux 10 | 0 | affected |
| Red Hat | Red Hat Enterprise Linux 10 | 3.8.13-1.hum1 | unaffected |
| Red Hat | Red Hat Enterprise Linux 6 | 0 | affected |
| Red Hat | Red Hat Enterprise Linux 6 | 3.8.13-1.hum1 | unaffected |
| Red Hat | Red Hat Enterprise Linux 7 | 0 | affected |
| Red Hat | Red Hat Enterprise Linux 7 | 3.8.13-1.hum1 | unaffected |
| Red Hat | Red Hat Enterprise Linux 8 | 0 | affected |
| Red Hat | Red Hat Enterprise Linux 8 | 3.8.13-1.hum1 | unaffected |
| Red Hat | Red Hat Enterprise Linux 9 | 0 | affected |
| Red Hat | Red Hat Enterprise Linux 9 | 3.8.13-1.hum1 | unaffected |
| Red Hat | Red Hat OpenShift Container Platform 4 | 0 | affected |
| Red Hat | Red Hat OpenShift Container Platform 4 | 3.8.13-1.hum1 | unaffected |