Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison

Summary

A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within `excludedSubtrees` or `permittedSubtrees`. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.

Timeline

1. Apr 30, 2026, 5:37 PM UTCCVE published
2. Apr 30, 2026, 6:37 PM UTCCISA SSVC assessment

   Exploitation: poc · Automatable: yes · Technical impact: partial

3. Oct 14, 2026, 7:24 PM UTCRecord last updated

Affected versions

• gnutls

  fixed in 3.8.13

• gnutls

  Version range not reported

• gnutls

  Version range not reported

• gnutls

  Version range not reported

• gnutls

  Version range not reported

• gnutls

  Version range not reported

• libtasn1

  Version range not reported

• gnutls

  Version range not reported

• libtasn1

  Version range not reported

• gnutls

  Version range not reported

• libtasn1

  Version range not reported

• gnutls

  Version range not reported

• libtasn1

  Version range not reported

• gnutls

  Version range not reported

• libtasn1

  Version range not reported

• gnutls

  Version range not reported

• libtasn1

  Version range not reported

• gnutls

  Version range not reported

• gnutls

  Version range not reported

• gnutls

  Version range not reported

• gnutls

  Version range not reported

• openshift/ose-rhel-coreos-8

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• cert-manager/jetstack-cert-manager-acmesolver-rhel9

  Version range not reported

• cert-manager/jetstack-cert-manager-rhel9

  Version range not reported

• cert-manager/cert-manager-operator-rhel9

  Version range not reported

• cert-manager/cert-manager-operator-bundle

  Version range not reported

• cert-manager/jetstack-cert-manager-acmesolver-rhel9

  Version range not reported

• cert-manager/jetstack-cert-manager-rhel9

  Version range not reported

• cert-manager/cert-manager-istio-csr-rhel9

  Version range not reported

• cert-manager/cert-manager-operator-rhel9

  Version range not reported

• cert-manager/cert-manager-operator-bundle

  Version range not reported

• cert-manager/cert-manager-trust-manager-rhel9

  Version range not reported

• discovery/discovery-server-rhel9

  Version range not reported

• discovery/discovery-ui-rhel9

  Version range not reported

• gnutls-main

  Version range not reported

• rhai/base-image-neuron-rhel9

  Version range not reported

• rhui5/cds-rhel9

  Version range not reported

• rhui5/haproxy-rhel9

  Version range not reported

• rhui5/installer-rhel9

  Version range not reported

• rhui5/rhua-rhel9

  Version range not reported

• rhui5/cds-kubernetes-tp-rhel9

  Version range not reported

• rhui5/installer-tp-rhel9

  Version range not reported

• rhui5/rhua-tp-rhel9

  Version range not reported

• gnutls

  Version range not reported

• openshift4/ose-hypershift-rhel9

  Version range not reported

References 25