GnuTLS CVE-2026-95184

The affected component must be GnuTLS version 3.8.13 performing X.509 certificate validation (i.e., a service or client using GnuTLS to authenticate peers via certificates). The denial of service is triggered during normal validation of legitimate certificates, so no attacker-supplied malicious input or special configuration is required - it is effectively a defect that activates in the ordinary certificate-handling path. The principal limiting factor is version scope: only deployments running GnuTLS 3.8.13 (and performing certificate validation) are impacted; environments pinned to other versions or not using certificate authentication are unaffected. Because the failure denies valid users rather than granting an attacker anything, there is no confidentiality or integrity exposure and no attacker weaponization path evident from the available data.

The input CVSS of 7.5 (HIGH) is driven entirely by availability impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity impact (C:N/I:N). The vector asserts remote, unauthenticated, low-complexity exploitation, but this conflicts with the description: the flaw causes GnuTLS to REJECT legitimate certificates for valid users, which reads as a functional/reliability regression (self-inflicted denial of service against your own valid users) rather than an attacker-weaponized remote DoS. In that reading AV:N/PR:N overstates attacker controllability - no external actor need act for legitimate users to be locked out. No EPSS score, no CISA KEV listing, no SSVC decision data, and no confirmed proof-of-concept were provided (one reference is a GitHub gist that MAY contain code but is unverified). There is therefore no evidence of active or widespread exploitation. Net assessment: this is best treated as a correctness/availability defect warranting a routine-to-prompt patch to restore service for valid users, NOT a high-urgency actively-exploited remote attack despite the HIGH CVSS. Note also a classification conflict: the description says 'improper certificate validation' (CWE-295 behavior) but the assigned CWE is CWE-400 (uncontrolled resource consumption) - verify the true root cause with the vendor.

A client or peer presents a legitimate, valid certificate to a service built on GnuTLS 3.8.13; the library improperly rejects it, and the valid user is denied access. Because this manifests during normal certificate validation, the denial of service can occur without any malicious action - it affects legitimate users of any service relying on the affected GnuTLS version. No public exploit identified at time of analysis (a referenced GitHub gist is unverified).