CVE-2026-67693: High severity GNUTLS GNUTLS vulnerability
An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU)
Other sources
GnuTLS v3.8.13 does not reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU). NOTE: the Supplier does not consider this an actionable security vulnerability because of its "threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)" policy.
— NVD
Affected Software
Event History
Frequently Asked Questions
What certificate condition is required for exploitation?
The end-entity X.509 certificate must contain a contradictory combination of Key Usage and Extended Key Usage values. The issue is that GnuTLS 3.8.13 fails to reject such certificates during verification.
What is the potential impact?
An attacker may obtain sensitive information if they can use an end-entity certificate with the contradictory KU and EKU combination described.