A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online Certificate Status Protocol (OCSP) response during a TLS handshake. Due to a logic error in how gnutls processes multi-record OCSP responses, a client with OCSP verification enabled may incorrectly accept a revoked server certificate, potentially leading to a compromise of trust.
CVSS Details
- CVSS 3.1 Base Score: 3.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade gnutls-develUpgrade gnutls-c++Upgrade gnutls-daneUpgrade gnutls-utilsUpgrade gnutls | Jul 2, 2026 | May 26, 2026 |
| Alpine Linux | — | Upgrade gnutls | May 4, 2026 | Apr 30, 2026 |
| Debian | — | Upgrade gnutls28 | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | Upgrade gnutls-dane-debuginfoUpgrade gnutls-fipsUpgrade gnutls-c++-debuginfoUpgrade gnutls-debuginfoUpgrade gnutlsNo solution existsUpgrade gnutls-debugsourceUpgrade gnutls-c++Upgrade gnutls-utilsUpgrade gnutls-daneUpgrade gnutls-develUpgrade gnutls-utils-debuginfo | Jun 3, 2026 | Apr 30, 2026 |
| Rocky_linux | — | Upgrade gnutls-utils-debuginfoUpgrade gnutls-dane-debuginfoUpgrade gnutls-utilsUpgrade gnutls-c++Upgrade gnutls-debugsourceUpgrade gnutls-debuginfoUpgrade gnutls-c++-debuginfoUpgrade gnutlsUpgrade gnutls-fipsUpgrade gnutls-daneUpgrade gnutls-devel | Jun 4, 2026 | Jun 2, 2026 |
| Suse | — | Upgrade libgnutlsxx30Upgrade libgnutls-develUpgrade libgnutlsxx-develUpgrade libgnutls-devel-docUpgrade libgnutls30Upgrade gnutls | May 28, 2026 | May 18, 2026 |
| Ubuntu | — | Upgrade libgnutls30Upgrade libgnutls30t64 | May 25, 2026 | May 20, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub