CVE-2026-3833: Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison
A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of nameConstraints labels, specifically for dNSName (DNS) or rfc822Name (email) constraints within excludedSubtrees or permittedSubtrees. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.
Other sources
gnutls compares nameConstraints labels using a case-sensitive memcmp path without an ascii-casefold canonicalization step. when excludedSubtrees/permittedSubtrees dNSName (dns) or rfc822Name (email) constraints are present, attacker-controlled casing differences in the leaf certificate SAN can cause a false accept (policy bypass) where the certificate should be rejected.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/gnutls28to a version that resolves this vulnerability.Fixed in 3.7.1-5+deb11u10Fixed in 3.7.9-2+deb12u7Fixed in 3.8.9-3+deb13u4Fixed in 3.8.13-1 - Upgrade
Upgrade
gnutlsto a version that resolves this vulnerability.Fixed in Last updated 6 July 2026 - Compensating control
If you cannot immediately upgrade gnutls, mitigate the certificate policy bypass by enforcing certificate SAN/nameConstraints label comparisons with ASCII case-folding in your certificate verification pipeline (so casing differences in dNSName or rfc822Name cannot cause a false accept).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3833?
CVE-2026-3833 has a moderate severity rating due to potential impact on name constraints processing.
How do I fix CVE-2026-3833?
To fix CVE-2026-3833, update GnuTLS to the latest version where the vulnerability has been patched.
What is the impact of CVE-2026-3833?
The impact of CVE-2026-3833 includes the possibility of policy bypass due to incorrect case-sensitive comparisons.
Which software is affected by CVE-2026-3833?
CVE-2026-3833 affects GnuTLS, particularly versions prior to the fix addressing the vulnerability.
Is there a workaround for CVE-2026-3833?
There are no known workarounds for CVE-2026-3833; updating GnuTLS is the recommended approach.