Bug#1150522: gnutls28: CVE-2026-67693 CVE-2026-88647 CVE-2026-88648 CVE-2026-95184 CVE-2026-95209 CVE-2026-95210

Maksimtech Security Sat, 10 Oct 2026 03:43:24 -0700

Package: src:gnutls28
Version: 3.8.13-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected]
Control: found -1 3.8.9-3+deb13u4


Dear Maintainer,

MITRE published six CVEs against GnuTLS 3.8.13 on 2026-10-08, all with
public proofs of concept (https://github.com/lkloliver/poc). The security
tracker currently notes "check if <gist> reported upstream, valid?" on
each; this report is meant to answer both halves.

Reproduced on 2026-10-10 with the Debian packages, running only certtool /
gnutls-cli / gnutls-serv on the published PEM files (none of the PoC
scripts), in debian:sid-slim and debian:trixie-slim containers:

  sid     3.8.13-1          all six reproduce
  trixie  3.8.9-3+deb13u4   all six reproduce (the 3.8.13 patch set is in,
                            so CVE-2026-88647 — which bypasses the
                            CVE-2026-42012 fix — applies to trixie as well)

Results, same on both:

CVE-2026-88647 SRV otherName with an OCTET STRING value does not suppress the CN fallback: gnutls-cli --verify-hostname=target.example

                  → "The certificate is trusted", handshake completed.
                  Controls: well-formed IA5String SRV → rejected (the 42012
                  fix works); no-SAN CN mismatch → rejected.
  CVE-2026-95210  critical keyUsage with extnValue 05 00 (ASN.1 NULL):

certtool --verify → trusted; certtool -i on the same file →

                  "get_key_usage: ASN1 parser: Error in TAG".
  CVE-2026-67693  critical keyUsage all-zero + EKU serverAuth → trusted by
                  certtool and by gnutls-cli (handshake completed).

CVE-2026-95184 EE O=Evil under permitted {directoryName: O=Good} → trusted

                  (OpenSSL 3.5/3.6: error 47 permitted subtree violation).
  CVE-2026-88648  defect 1 as 95184; defect 2: EE carrying an excluded SRV

otherName → trusted (OpenSSL: error 51); defect 3: EE O=Good

                  under excluded {directoryName: O=Blocked} → rejected
                  (OpenSSL: OK).
  CVE-2026-95209  SAN-less leaf CN=random.host.org under permitted
                  {dNSName: example.com} → rejected. OpenSSL rejects too;
                  arguably intended behaviour, listed for completeness.

Upstream: no public GnuTLS issue existed for any of the six as of
2026-10-10. Reported to GnuTLS as confidential issue
https://gitlab.com/gnutls/gnutls/-/work_items/1965 the same day, with the
transcripts below. Red Hat bugzilla has auto-imported entries (e.g.
#2548057 for CVE-2026-88647, #2548190 for CVE-2026-67693), status NEW.

Reachability note for the "CA within the trust boundary" question:
88647, 95210 and 67693 need only a CA-signed end-entity certificate with a
malformed extension; 95184, 88648 and 95209 need a constrained
subordinate CA, i.e. exactly the case name constraints exist for.

Transcripts (certtool / gnutls-cli output for every case and control) are
attached; the runner script is a dozen certtool invocations and is attached
too.

Thank you for your work on Debian.

--
--
Massimo Moretti
Analista Tecnico Indipendente – Sicurezza Email & DNS
noyb Supporting Member — Gold #7645
PGP: 8225 11BB 48EE 20F5 6D44 56E9 5CDE 28FF FD5F 22EA

Unable to find image 'debian:sid-slim' locally
sid-slim: Pulling from library/debian
3a86a893412c: Pulling fs layer
86290399b716: Download complete
3a86a893412c: Download complete
3a86a893412c: Pull complete
Digest: sha256:1f11c32b03195c1b28c55e4579755659edae5c76dd76a69b4e4fb34c58fa8744
Status: Downloaded newer image for debian:sid-slim
== suite: Debian GNU/Linux forky/sid
== packages: gnutls-bin 3.8.13-1;libgnutls30t64 3.8.13-1;openssl 3.6.5-1;
== certtool: certtool 3.8.13
### CVE-2026-95210 (critical keyUsage with ASN.1 NULL value)
-- gnutls leaf w/ malformed critical KU
        Output: Verified. The certificate is trusted. 
   Chain verification output: Verified. The certificate is trusted. 
   openssl control [95210]: CN=kn-crit error 20 at 0 depth lookup: unable to 
get local issuer certificate error /poc/CVE-2026-95210/kn_crit_leaf.pem: 
verification failed 4027093B807F0000:e
   KU readback:                 Key Usage (critical):|error: get_key_usage: 
ASN1 parser: Error in TAG.|
### CVE-2026-67693 (critical KU all-zero + EKU serverAuth)
-- gnutls mismatch leaf
        Output: Verified. The certificate is trusted. 
   Chain verification output: Verified. The certificate is trusted. 
-- gnutls good leaf (control)
        Output: Verified. The certificate is trusted. 
   Chain verification output: Verified. The certificate is trusted. 
   openssl control [67693 mismatch]: C=US, CN=poc-cve-2026-67693.local error 20 
at 0 depth lookup: unable to get local issuer certificate error 
/poc/CVE-2026-67693/certs/mismatch/leaf.pem: verifica
   KU of mismatch leaf:                 Key Usage (critical):           Key 
Purpose (not critical):                     TLS WWW Server.                     
    TLS WWW Client. 
### CVE-2026-95209 (dNSName constraint applied to CN of SAN-less leaf)
-- gnutls leaf CN=random.host.org no SAN under permitted dNSName example.com
        Output: Verified. The certificate is trusted. 
        Output: Not verified. The certificate is NOT trusted. The certificate 
chain violates the signer's constraints. 
   Chain verification output: Not verified. The certificate is NOT trusted. The 
certificate chain violates the signer's constraints. 
   openssl control [95209]: CN=random.host.org error 47 at 0 depth lookup: 
permitted subtree violation error /poc/CVE-2026-95209/leaf.pem: verification 
failed 
### CVE-2026-95184 (permitted directoryName not enforced)
-- gnutls EE O=Evil under permitted O=Good
        Output: Verified. The certificate is trusted. 
        Output: Verified. The certificate is trusted. 
   Chain verification output: Verified. The certificate is trusted. 
   openssl control [95184]: O=Evil, CN=x error 47 at 0 depth lookup: permitted 
subtree violation error /poc/CVE-2026-95184/perm_dn_ee.pem: verification failed 
### CVE-2026-88648 (name constraints: 3 defects)
-- defect1 EE O=Evil under permitted O=Good
        Output: Verified. The certificate is trusted. 
        Output: Verified. The certificate is trusted. 
   Chain verification output: Verified. The certificate is trusted. 
-- defect2 EE with excluded SRV otherName
        Output: Verified. The certificate is trusted. 
   Chain verification output: Verified. The certificate is trusted. 
   openssl control [88648 d2]: CN=srv-ee error 51 at 0 depth lookup: 
unsupported name constraint type error 
/poc/CVE-2026-88648/evidence-defect23/d2s_ee.pem: verification failed 
-- defect3 EE O=Good under excluded O=Blocked (should be accepted)
        Output: Verified. The certificate is trusted. 
        Output: Not verified. The certificate is NOT trusted. The certificate 
chain violates the signer's constraints. 
   Chain verification output: Not verified. The certificate is NOT trusted. The 
certificate chain violates the signer's constraints. 
   openssl control [88648 d3]: /poc/CVE-2026-88648/evidence-defect23/d3_ee.pem: 
OK 
### CVE-2026-88647 (OCTET STRING SRV otherName does not suppress CN fallback) - 
TLS handshake
   SAN of ca_bad:       Subject: CN=target.example      Subject Public Key 
Algorithm: RSA       Algorithm Security Level: Medium (2048 bits) --            
     Subject Alternative Name (not critical):                        otherName 
OID: 1.3.6.1.5.5.7.8.7                        otherName DER: 04185f73697
-- negative control: no SAN, CN=elsewhere.example
   *** Fatal error: Error in the certificate.
   - Status: The certificate is NOT trusted. The name in the certificate does 
not match the expected. 
   *** PKI verification of server certificate failed...
-- control: IA5String SRV otherName + CN=target.example (fixed by 
CVE-2026-42012 -> must be rejected)
   *** Fatal error: Error in the certificate.
   - Status: The certificate is NOT trusted. The name in the certificate does 
not match the expected. 
   *** PKI verification of server certificate failed...
-- BAD: OCTET STRING SRV otherName + CN=target.example
   - Status: The certificate is trusted. 
   - Handshake was completed
### CVE-2026-67693 - TLS handshake with mismatch leaf (openssl s_server)
   leaf subject/SAN:    Subject: CN=poc-cve-2026-67693.local,C=US               
        DNSname: poc-cve-2026-67693.local 
   - Status: The certificate is trusted. 
   - Handshake was completed
== done

Unable to find image 'debian:trixie-slim' locally
trixie-slim: Pulling from library/debian
4a3ac7ed06b6: Download complete
Digest: sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f
Status: Downloaded newer image for debian:trixie-slim
== suite: Debian GNU/Linux 13 (trixie)
== packages: gnutls-bin 3.8.9-3+deb13u4;libgnutls30t64 3.8.9-3+deb13u4;openssl 
3.5.7-1~deb13u3;
== certtool: certtool 3.8.9
### CVE-2026-95210 (critical keyUsage with ASN.1 NULL value)
-- gnutls leaf w/ malformed critical KU
        Output: Verified. The certificate is trusted. 
   Chain verification output: Verified. The certificate is trusted. 
   openssl control [95210]: CN=kn-crit error 20 at 0 depth lookup: unable to 
get local issuer certificate error /poc/CVE-2026-95210/kn_crit_leaf.pem: 
verification failed 40473EB9F07F0000:e
   KU readback:                 Key Usage (critical):|error: get_key_usage: 
ASN1 parser: Error in TAG.|
### CVE-2026-67693 (critical KU all-zero + EKU serverAuth)
-- gnutls mismatch leaf
        Output: Verified. The certificate is trusted. 
   Chain verification output: Verified. The certificate is trusted. 
-- gnutls good leaf (control)
        Output: Verified. The certificate is trusted. 
   Chain verification output: Verified. The certificate is trusted. 
   openssl control [67693 mismatch]: C=US, CN=poc-cve-2026-67693.local error 20 
at 0 depth lookup: unable to get local issuer certificate error 
/poc/CVE-2026-67693/certs/mismatch/leaf.pem: verifica
   KU of mismatch leaf:                 Key Usage (critical):           Key 
Purpose (not critical):                     TLS WWW Server.                     
    TLS WWW Client. 
### CVE-2026-95209 (dNSName constraint applied to CN of SAN-less leaf)
-- gnutls leaf CN=random.host.org no SAN under permitted dNSName example.com
        Output: Verified. The certificate is trusted. 
        Output: Not verified. The certificate is NOT trusted. The certificate 
chain violates the signer's constraints. 
   Chain verification output: Not verified. The certificate is NOT trusted. The 
certificate chain violates the signer's constraints. 
   openssl control [95209]: CN=random.host.org error 47 at 0 depth lookup: 
permitted subtree violation error /poc/CVE-2026-95209/leaf.pem: verification 
failed 
### CVE-2026-95184 (permitted directoryName not enforced)
-- gnutls EE O=Evil under permitted O=Good
        Output: Verified. The certificate is trusted. 
        Output: Verified. The certificate is trusted. 
   Chain verification output: Verified. The certificate is trusted. 
   openssl control [95184]: O=Evil, CN=x error 47 at 0 depth lookup: permitted 
subtree violation error /poc/CVE-2026-95184/perm_dn_ee.pem: verification failed 
### CVE-2026-88648 (name constraints: 3 defects)
-- defect1 EE O=Evil under permitted O=Good
        Output: Verified. The certificate is trusted. 
        Output: Verified. The certificate is trusted. 
   Chain verification output: Verified. The certificate is trusted. 
-- defect2 EE with excluded SRV otherName
        Output: Verified. The certificate is trusted. 
   Chain verification output: Verified. The certificate is trusted. 
   openssl control [88648 d2]: CN=srv-ee error 51 at 0 depth lookup: 
unsupported name constraint type error 
/poc/CVE-2026-88648/evidence-defect23/d2s_ee.pem: verification failed 
-- defect3 EE O=Good under excluded O=Blocked (should be accepted)
        Output: Verified. The certificate is trusted. 
        Output: Not verified. The certificate is NOT trusted. The certificate 
chain violates the signer's constraints. 
   Chain verification output: Not verified. The certificate is NOT trusted. The 
certificate chain violates the signer's constraints. 
   openssl control [88648 d3]: /poc/CVE-2026-88648/evidence-defect23/d3_ee.pem: 
OK 
### CVE-2026-88647 (OCTET STRING SRV otherName does not suppress CN fallback) - 
TLS handshake
   SAN of ca_bad:       Subject: CN=target.example      Subject Public Key 
Algorithm: RSA       Algorithm Security Level: Medium (2048 bits) --            
     Subject Alternative Name (not critical):                        otherName 
OID: 1.3.6.1.5.5.7.8.7                        otherName DER: 04185f73697
-- negative control: no SAN, CN=elsewhere.example
   *** Fatal error: Error in the certificate.
   - Status: The certificate is NOT trusted. The name in the certificate does 
not match the expected. 
   *** PKI verification of server certificate failed...
-- control: IA5String SRV otherName + CN=target.example (fixed by 
CVE-2026-42012 -> must be rejected)
   *** Fatal error: Error in the certificate.
   - Status: The certificate is NOT trusted. The name in the certificate does 
not match the expected. 
   *** PKI verification of server certificate failed...
-- BAD: OCTET STRING SRV otherName + CN=target.example
   - Status: The certificate is trusted. 
   - Handshake was completed
### CVE-2026-67693 - TLS handshake with mismatch leaf (openssl s_server)
   leaf subject/SAN:    Subject: CN=poc-cve-2026-67693.local,C=US               
        DNSname: poc-cve-2026-67693.local 
   - Status: The certificate is trusted. 
   - Handshake was completed
== done

#!/bin/sh
# Reproduce the six gnutls 3.8.13 CVE PoCs against the Debian gnutls28 package.
# Only certtool/gnutls-cli/gnutls-serv/openssl are run on the PEM files; no PoC 
script is executed.
set -u
export DEBIAN_FRONTEND=noninteractive
apt-get update -qq >/dev/null 2>&1
apt-get install -y -qq --no-install-recommends gnutls-bin openssl 
ca-certificates >/dev/null 2>&1
echo "== suite: $(. /etc/os-release; echo $PRETTY_NAME)"
echo "== packages: $(dpkg-query -W -f='${Package} ${Version}\n' libgnutls30t64 
gnutls-bin openssl | tr '\n' ';')"
echo "== certtool: $(certtool --version | head -1)"
P=/poc; W=/tmp/w; mkdir -p $W; cd $W
v(){ # v <label> <ca> <chain...>
  l=$1; ca=$2; shift 2; cat "$@" > chain.pem
  out=$(certtool --verify --load-ca-certificate "$ca" --infile chain.pem 2>&1)
  echo "-- $l"; echo "$out" | grep -E 'Chain 
verification|trusted|violates|constraint|error|Error' | sed 's/^/   /'
}
o(){ # o <label> <ca> <untrusted or -> <leaf>
  l=$1; ca=$2; u=$3; leaf=$4
  if [ "$u" = - ]; then out=$(openssl verify -CAfile "$ca" "$leaf" 2>&1); else 
out=$(openssl verify -CAfile "$ca" -untrusted "$u" "$leaf" 2>&1); fi
  echo "   openssl control [$l]: $(echo "$out" | tr '\n' ' ' | cut -c1-160)"
}
echo "### CVE-2026-95210 (critical keyUsage with ASN.1 NULL value)"
v "gnutls leaf w/ malformed critical KU" $P/CVE-2026-95210/kn_crit_ca.pem 
$P/CVE-2026-95210/kn_crit_leaf.pem
o "95210" $P/CVE-2026-95210/kn_crit_ca.pem - $P/CVE-2026-95210/kn_crit_leaf.pem
echo "   KU readback: $(certtool -i --infile $P/CVE-2026-95210/kn_crit_leaf.pem 
2>&1 | grep -iE 'key usage|error|tag' | head -3 | tr '\n' '|')"
echo "### CVE-2026-67693 (critical KU all-zero + EKU serverAuth)"
v "gnutls mismatch leaf" $P/CVE-2026-67693/certs/mismatch/ca.pem 
$P/CVE-2026-67693/certs/mismatch/leaf.pem
v "gnutls good leaf (control)" $P/CVE-2026-67693/certs/good/ca.pem 
$P/CVE-2026-67693/certs/good/leaf.pem
o "67693 mismatch" $P/CVE-2026-67693/certs/mismatch/ca.pem - 
$P/CVE-2026-67693/certs/mismatch/leaf.pem
echo "   KU of mismatch leaf: $(certtool -i --infile 
$P/CVE-2026-67693/certs/mismatch/leaf.pem 2>&1 | grep -A3 -i 'key usage' | tr 
-s ' \n' ' ' | cut -c1-200)"
echo "### CVE-2026-95209 (dNSName constraint applied to CN of SAN-less leaf)"
v "gnutls leaf CN=random.host.org no SAN under permitted dNSName example.com" 
$P/CVE-2026-95209/root.pem $P/CVE-2026-95209/leaf.pem $P/CVE-2026-95209/sub.pem
o "95209" $P/CVE-2026-95209/root.pem $P/CVE-2026-95209/sub.pem 
$P/CVE-2026-95209/leaf.pem
echo "### CVE-2026-95184 (permitted directoryName not enforced)"
v "gnutls EE O=Evil under permitted O=Good" $P/CVE-2026-95184/perm_dn_root.pem 
$P/CVE-2026-95184/perm_dn_ee.pem $P/CVE-2026-95184/perm_dn_sub.pem
o "95184" $P/CVE-2026-95184/perm_dn_root.pem $P/CVE-2026-95184/perm_dn_sub.pem 
$P/CVE-2026-95184/perm_dn_ee.pem
echo "### CVE-2026-88648 (name constraints: 3 defects)"
v "defect1 EE O=Evil under permitted O=Good" $P/CVE-2026-88648/perm_dn_root.pem 
$P/CVE-2026-88648/perm_dn_ee.pem $P/CVE-2026-88648/perm_dn_sub.pem
v "defect2 EE with excluded SRV otherName" 
$P/CVE-2026-88648/evidence-defect23/d2s_root.pem 
$P/CVE-2026-88648/evidence-defect23/d2s_ee.pem
o "88648 d2" $P/CVE-2026-88648/evidence-defect23/d2s_root.pem - 
$P/CVE-2026-88648/evidence-defect23/d2s_ee.pem
v "defect3 EE O=Good under excluded O=Blocked (should be accepted)" 
$P/CVE-2026-88648/evidence-defect23/d3_root.pem 
$P/CVE-2026-88648/evidence-defect23/d3_ee.pem 
$P/CVE-2026-88648/evidence-defect23/d3_sub.pem
o "88648 d3" $P/CVE-2026-88648/evidence-defect23/d3_root.pem 
$P/CVE-2026-88648/evidence-defect23/d3_sub.pem 
$P/CVE-2026-88648/evidence-defect23/d3_ee.pem
echo "### CVE-2026-88647 (OCTET STRING SRV otherName does not suppress CN 
fallback) - TLS handshake"
echo "   SAN of ca_bad: $(certtool -i --infile $P/CVE-2026-88647/ca_bad.pem 
2>&1 | grep -iE -A2 'Alternative|Subject:' | tr -s ' \n' ' ' | cut -c1-220)"
hs(){ # hs <label> <cert> <key> <port>
  gnutls-serv --echo --x509certfile "$2" --x509keyfile "$3" -p $4 >/dev/null 
2>&1 &
  sp=$!; sleep 1
  out=$(echo Q | timeout 10 gnutls-cli --x509cafile $P/CVE-2026-88647/ca.pem 
--verify-hostname=target.example -p $4 127.0.0.1 2>&1)
  kill $sp 2>/dev/null; wait $sp 2>/dev/null
  echo "-- $1"; echo "$out" | grep -E 'trusted|does not match|Handshake was 
completed|Error|error|verification' | head -4 | sed 's/^/   /'
}
hs "negative control: no SAN, CN=elsewhere.example" 
$P/CVE-2026-88647/ca_nomatch.pem $P/CVE-2026-88647/ca_nomatch.key 17447
hs "control: IA5String SRV otherName + CN=target.example (fixed by 
CVE-2026-42012 -> must be rejected)" $P/CVE-2026-88647/ca_good.pem 
$P/CVE-2026-88647/ca_good.key 17448
hs "BAD: OCTET STRING SRV otherName + CN=target.example" 
$P/CVE-2026-88647/ca_bad.pem $P/CVE-2026-88647/ca_bad.key 17449
echo "### CVE-2026-67693 - TLS handshake with mismatch leaf (openssl s_server)"
openssl s_server -accept 14443 -www -cert 
$P/CVE-2026-67693/certs/mismatch/leaf.pem -key 
$P/CVE-2026-67693/certs/mismatch/leaf.key -quiet >/dev/null 2>&1 &
sp=$!; sleep 1
echo "   leaf subject/SAN: $(certtool -i --infile 
$P/CVE-2026-67693/certs/mismatch/leaf.pem 2>&1 | grep -iE 'Subject:|DNSname' | 
tr -s ' \n' ' ' | cut -c1-200)"
host=$(certtool -i --infile $P/CVE-2026-67693/certs/mismatch/leaf.pem 2>&1 | 
grep -i 'DNSname' | head -1 | awk '{print $NF}')
out=$(timeout 10 gnutls-cli --x509cafile 
$P/CVE-2026-67693/certs/mismatch/ca.pem --verify-hostname=${host:-localhost} -p 
14443 127.0.0.1 </dev/null 2>&1)
kill $sp 2>/dev/null
echo "$out" | grep -E 'trusted|does not match|Handshake was 
completed|Error|error|verification|key usage' | head -4 | sed 's/^/   /'
echo "== done"

OpenPGP_0x5CDE28FFFD5F22EA.asc
Description: OpenPGP public key

OpenPGP_signature.asc
Description: OpenPGP digital signature

Bug#1150522: gnutls28: CVE-2026-67693 CVE-2026-88647 CVE-2026-88648 CVE-2026-95184 CVE-2026-95209 CVE-2026-95210

Reply via email to