CVE-2026-88647

Published: Oct 8, 2026Modified: Oct 19, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

Exploitability: 2.2 / Impact: 4.2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certificate.

Related CWEs

CWE-297

Improper Validation of Certificate with Host Mismatch

The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.

References (2)

https://gist.github.com/lkloliver/f98ec3de1a871fdfc02b70b8b9ba7642

Source: cve@mitre.org

https://gitlab.com/gnutls/gnutls/-/issues/1802

Source: cve@mitre.org

Timeline

No history available yet.