GnuTLS EUVD-2026-95206

The target application must use GnuTLS 3.8.13 to perform X.509 end-entity certificate verification and rely on Key Usage / Extended Key Usage constraints for trust decisions. The attacker must be able to supply a crafted end-entity certificate containing a contradictory KU/EKU combination that GnuTLS fails to reject, which in practice requires a man-in-the-middle position on the TLS path or control of a server/endpoint the victim connects to. Limiting factors: exploitation is only meaningful where applications depend on KU/EKU enforcement, and the attacker must deliver the malicious certificate into the validation flow rather than act purely remotely with no interaction with the victim's TLS session.

Signals are moderately conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 7.5 HIGH) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality impact, which looks severe in isolation. However, CISA SSVC tempers this: Exploitation is rated 'none' (no observed exploitation or confirmed POC), Technical Impact is only 'partial', and while Automatable is 'yes', the real-world precondition (an attacker must present a crafted certificate, typically from a MITM or malicious-server position) makes opportunistic mass-exploitation less realistic than AC:L alone suggests. No EPSS score was provided, so exploitation probability cannot be quantified from this data. This is not in CISA KEV and no public exploit is confirmed, though a referenced GitHub gist may contain proof-of-concept material (unverified). Net: a genuine certificate-validation weakness in a widely-used TLS library that warrants patching on a normal remediation cycle, but not emergency/zero-day handling. Note a data inconsistency: CWE-367 (TOCTOU race condition) does not match the described certificate KU/EKU logic flaw - verify the CWE with the vendor.

An attacker in a man-in-the-middle position (or operating a malicious server a GnuTLS client connects to) presents an end-entity X.509 certificate containing a contradictory combination of Key Usage and Extended Key Usage extensions. GnuTLS 3.8.13 fails to reject the certificate as it should, allowing the attacker to be trusted for a purpose the certificate was never valid for and thereby obtain sensitive information from the session. A GitHub gist referenced in the advisory may contain proof-of-concept material, but no confirmed public exploit or active exploitation exists at time of analysis.