CVE-2026-3832: Gnutls: gnutls: security bypass allows acceptance of revoked server certificates via crafted ocsp response
A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online Certificate Status Protocol (OCSP) response during a TLS handshake. Due to a logic error in how gnutls processes multi-record OCSP responses, a client with OCSP verification enabled may incorrectly accept a revoked server certificate, potentially leading to a compromise of trust.
Other sources
gnutls matches a stapled ocsp response to the server certificate by scanning SingleResponse records, but then reads certstatus from record index 0 unconditionally. when a multi-record ocsp response is stapled such that record 0 is for a different certificate (good) and the matching record for the server certificate is later (revoked), a client with ocsp verification enabled can accept a revoked server certificate. this is observable as an order-dependent accept/reject outcome for the same revoked server certificate.
— Red Hat
Gnutls: gnutls: security bypass allows acceptance of revoked server certificates via crafted ocsp response
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.8.3-10 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.8.3-11
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3832?
CVE-2026-3832 has been classified as a security vulnerability that could allow a remote attacker to bypass certificate revocation checks.
How do I fix CVE-2026-3832?
To mitigate CVE-2026-3832, update GnuTLS and related software to the latest patched version.
What impact does CVE-2026-3832 have on TLS connections?
CVE-2026-3832 may lead to a vulnerability where revoked server certificates can be accepted, compromising the integrity of TLS connections.
Which software is affected by CVE-2026-3832?
CVE-2026-3832 affects GnuTLS, as well as various versions of Red Hat Enterprise Linux and OpenShift Container Platform.
Can CVE-2026-3832 be exploited remotely?
Yes, CVE-2026-3832 can be exploited remotely by an attacker presenting a manipulated OCSP response during a TLS handshake.