CVE-2026-3833: Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison
A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within `excludedSubtrees` or `permittedSubtrees`. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3833?
CVE-2026-3833 has a moderate severity rating due to potential impact on name constraints processing.
How do I fix CVE-2026-3833?
To fix CVE-2026-3833, update GnuTLS to the latest version where the vulnerability has been patched.
What is the impact of CVE-2026-3833?
The impact of CVE-2026-3833 includes the possibility of policy bypass due to incorrect case-sensitive comparisons.
Which software is affected by CVE-2026-3833?
CVE-2026-3833 affects GnuTLS, particularly versions prior to the fix addressing the vulnerability.
Is there a workaround for CVE-2026-3833?
There are no known workarounds for CVE-2026-3833; updating GnuTLS is the recommended approach.