Hostname Verification Bypass in GnuTLS

Executive Summary

CVE-2026-88647 is a hostname verification bypass in GnuTLS v3.8.13 where the software incorrectly falls back to using the Common Name (CN) for hostname verification when a certificate contains a Subject Alternative Name (SAN) entry with an unsupported type, such as a URI. This violates RFC 6125, which requires suppressing CN checks when SAN is present.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect GnuTLS versions and certificate validation behavior. Check for GnuTLS 3.8.13 and examine certificates with URI or SRV SAN entries. Use tools like openssl to inspect certificates and verify hostname validation logic in applications using GnuTLS.

Useful 0 Not Useful 0

Impact Analysis

Attackers can exploit this vulnerability to bypass hostname validation by presenting a crafted certificate with a URI or malformed SRV SAN entry. If they control a certificate authority or issue a certificate with a victim hostname in the CN, GnuTLS clients may trust the wrong host, enabling eavesdropping or unauthorized access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability undermines secure TLS communication, which is critical for compliance with GDPR (data protection) and HIPAA (healthcare data privacy). Bypassing hostname verification risks unauthorized access to sensitive data, violating confidentiality requirements and potentially leading to regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Update GnuTLS to a patched version that disables CN fallback when any SAN is present. Review and revoke certificates with URI or malformed SRV SAN entries. Ensure strict hostname verification is enforced in client configurations.

Useful 0 Not Useful 0