CVE-2026-95210

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-08

Last updated on: 2026-11-04

Assigner: MITRE

Description

GnuTLS v3.8.13 does not reject a critical keyUsage extension when it cannot be processed, such as when extnValue is an ASN.1 NULL (05 00) instead of a BIT STRING. NOTE: the Supplier does not consider this an actionable security vulnerability because of its "threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)" policy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-11-04

Generated

2026-11-08

AI Q&A

2026-10-08

EPSS Evaluated

2026-11-07

NVD

CVE-2026-95210

EUVD

EUVD-2026-95139

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	n/a	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

Executive Summary

CVE-2026-95210 is an improper certificate validation flaw in GnuTLS version 3.8.13. It allows untrusted certificates with invalid extensions to pass security checks. The issue occurs because GnuTLS does not properly parse certificate extension values during validation, only checking their identifiers. This lets attackers present malformed certificates that GnuTLS initially trusts.

Detection Guidance

To detect CVE-2026-95210, check GnuTLS version 3.8.13 for improper certificate validation. Use certtool to inspect certificates for invalid keyUsage extensions with ASN.1 NULL values. Commands: gnutls-cli --version to verify version, certtool -i <certificate> to parse certificate extensions. Look for GNUTLS_E_ASN1_TAG_ERROR during keyUsage access.

Impact Analysis

This vulnerability could allow attackers to bypass security checks by presenting invalid certificates that GnuTLS incorrectly trusts. Applications using GnuTLS may accept untrusted certificates, leading to potential man-in-the-middle attacks or unauthorized access. Errors may only appear later when applications try to read certificate extensions.

Compliance Impact

This vulnerability could undermine compliance with GDPR and HIPAA by allowing invalid certificates to be accepted during authentication. GDPR requires strong security measures for data protection, while HIPAA mandates secure transmission of protected health information. Accepting malformed certificates may expose systems to man-in-the-middle attacks, violating integrity and confidentiality requirements.

Mitigation Strategies

Upgrade GnuTLS to a patched version beyond 3.8.13. Avoid relying solely on GnuTLS for certificate validation. Implement additional validation checks in applications using keyUsage policies. Monitor for GNUTLS_E_ASN1_TAG_ERROR errors in logs.

Hi! I’m here to help you understand CVE-2026-95210. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...