CVE-2026-3833

Published: Apr 30, 2026

Modified: Jun 2, 2026

PUBLISHED

CVSS v3.1

6.5

MEDIUM

Description

A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within `excludedSubtrees` or `permittedSubtrees`. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.

Vendor	Product	Versions
Unknown	gnutls	affected `0 - < 3.8.13`
Red Hat	Red Hat Enterprise Linux 10	unaffected `0:3.8.10-4.el10_2 - < *`
Red Hat	Red Hat Enterprise Linux 8	unaffected `0:3.6.16-8.el8_10.6 - < *`
Red Hat	Red Hat Enterprise Linux 8	unaffected `0:3.6.16-8.el8_10.6 - < *`
Red Hat	Red Hat Enterprise Linux 9	unaffected `0:3.8.10-4.el9_8 - < *`
Red Hat	Red Hat Enterprise Linux 9	unaffected `0:3.8.10-4.el9_8 - < *`
Red Hat	Red Hat Hardened Images	unaffected `3.8.13-1.hum1 - < *`
Red Hat	Red Hat Enterprise Linux 6	All versions
Red Hat	Red Hat Enterprise Linux 7	All versions
Red Hat	Red Hat OpenShift Container Platform 4	All versions