CVE-2026-88647

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-08

Last updated on: 2026-11-04

Assigner: MITRE

Description

GnuTLS v3.8.13 can perhaps unexpectedly trust a certificate on the basis of Common Name when Subject Alternative Name has an SRV otherName (1.3.6.1.5.5.7.8.7) whose value is an OCTET STRING. NOTE: the Supplier does not consider this an actionable security vulnerability because of its "threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)" policy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-11-04

Generated

2026-11-08

AI Q&A

2026-10-08

EPSS Evaluated

2026-11-07

NVD

CVE-2026-88647

EUVD

EUVD-2026-95113

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	n/a	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-297	The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.

Attack-Flow Graph

Executive Summary

CVE-2026-88647 is a hostname verification bypass in GnuTLS v3.8.13 where the software incorrectly falls back to using the Common Name (CN) for hostname verification when a certificate contains a Subject Alternative Name (SAN) entry with an unsupported type, such as a URI. This violates RFC 6125, which requires suppressing CN checks when SAN is present.

Detection Guidance

To detect this vulnerability, inspect GnuTLS versions and certificate validation behavior. Check for GnuTLS 3.8.13 and examine certificates with URI or SRV SAN entries. Use tools like openssl to inspect certificates and verify hostname validation logic in applications using GnuTLS.

Impact Analysis

Attackers can exploit this vulnerability to bypass hostname validation by presenting a crafted certificate with a URI or malformed SRV SAN entry. If they control a certificate authority or issue a certificate with a victim hostname in the CN, GnuTLS clients may trust the wrong host, enabling eavesdropping or unauthorized access.

Compliance Impact

This vulnerability undermines secure TLS communication, which is critical for compliance with GDPR (data protection) and HIPAA (healthcare data privacy). Bypassing hostname verification risks unauthorized access to sensitive data, violating confidentiality requirements and potentially leading to regulatory penalties.

Mitigation Strategies

Update GnuTLS to a patched version that disables CN fallback when any SAN is present. Review and revoke certificates with URI or malformed SRV SAN entries. Ensure strict hostname verification is enforced in client configurations.

Hi! I’m here to help you understand CVE-2026-88647. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...