Gnutls: gnutls: certificate validation bypass due to improper handling of uri and srv sans

Versions reported by the vendor

Affected version ranges reported by the assigning authority (redhat). Independent of NVD's CPE analysis and usually ahead of it.

• gitlab.com/gnutls/gnutls gnutls

  • 0affected

• Red Hat Red Hat Discovery 2

  • 1782159791 and laternot affected · rpm
  • 1782166952 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 10

  • 0:3.8.10-4.el10_2 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support

  • 0:3.8.9-9.el10_0.19 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 6

  • all versionsaffected

• Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support

  • 0:3.3.29-9.el7_9.2 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8

  • 0:3.6.16-8.el8_10.6 and laternot affected · rpm
  • 0:3.6.16-8.el8_10.6 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

  • 0:3.6.14-10.el8_4.1 and laternot affected · rpm
  • 0:4.13-3.el8_4.1 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

  • 0:3.6.14-10.el8_4.1 and laternot affected · rpm
  • 0:4.13-3.el8_4.1 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

  • 0:3.6.16-5.el8_6.5 and laternot affected · rpm
  • 0:4.13-3.el8_6.2 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

  • 0:3.6.16-5.el8_6.5 and laternot affected · rpm
  • 0:4.13-3.el8_6.2 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service

  • 0:3.6.16-7.el8_8.4 and laternot affected · rpm
  • 0:4.13-4.el8_8.1 and laternot affected · rpm

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2025-10230Samba: command injection in wins server hook script
  52Plan
• CVE-2026-4631Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection
  42Plan
• CVE-2026-76578Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci
  39Monitor
• CVE-2025-4404Freeipa: idm: privilege escalation from host to domain admin in freeipa
  37Monitor
• CVE-2025-7493Freeipa: idm: privilege escalation from host to domain admin in freeipa
  36Monitor
• CVE-2025-49796Libxml: type confusion leads to denial of service (dos)
  36Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A certificate validation error is silently swallowed instead of terminating the connection. Often, code added for a test environment makes its way into production.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1override fun checkServerTrusted(chain: Array<X509Certificate>, type: String) {2  // Left empty for the test environment3}

1val client = OkHttpClient.Builder()2  .certificatePinner(3    CertificatePinner.Builder()4      .add("api.sirius.example", "sha256/…")5      .build()6  ).build()

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.