Improper Certificate Validation in GnuTLS - CVE-2026-3832

Vulnerability identifier: #VU128579

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-3832

CWE-ID: CWE-295

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass certificate revocation checks.

The vulnerability exists due to improper certificate status validation in OCSP response processing when validating a certificate against a multi-entry OCSP response. A remote attacker can supply a certificate status response with multiple entries to bypass certificate revocation checks.

GnuTLS
Debian Linux
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
openEuler
Ubuntu
gnutls-help
gnutls-utils
gnutls-devel
gnutls-debugsource
gnutls-debuginfo
gnutls
gnutls28 (Ubuntu package)
gnutls28 (Debian package)
gnutls-dane
gnutls (Red Hat package)

Install security update from vendor's website.

GnuTLS - update to 3.8.13
gnutls-help - addressed in versions 3.6.14-24, 3.7.2-25, 3.8.2-16
gnutls-utils - addressed in versions 3.6.14-24, 3.7.2-25, 3.8.2-16
gnutls-devel - addressed in versions 3.6.14-24, 3.7.2-25, 3.8.2-16
gnutls-debugsource - addressed in versions 3.6.14-24, 3.7.2-25, 3.8.2-16
gnutls-debuginfo - addressed in versions 3.6.14-24, 3.7.2-25, 3.8.2-16
gnutls - addressed in versions 3.6.14-24, 3.7.2-25, 3.8.2-16
gnutls28 (Ubuntu package) - addressed in versions 3.7.3-4ubuntu1.9, 3.8.3-1.1ubuntu3.6, 3.8.9-3ubuntu2.2, 3.8.12-2ubuntu1.1
gnutls28 (Debian package) - addressed in versions 3.7.9-2+deb12u7, 3.8.9-3+deb13u4
gnutls-dane - update to 3.8.2-16
gnutls (Red Hat package) - update to 3.8.9-9.el10_0.19

• https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-12
• https://gitlab.com/gnutls/gnutls/-/issues/1801

• Multiple vulnerabilities in GnuTLS
• Debian update for gnutls28
• Ubuntu update for gnutls28
• Red Hat Enterprise Linux 10 update for gnutls
• openEuler 24.03 LTS SP3 update for gnutls
• openEuler 24.03 LTS SP1 update for gnutls
• openEuler 22.03 LTS SP4 update for gnutls
• openEuler 20.03 LTS SP4 update for gnutls