{"id":"CVE-2026-67693","published":"2026-10-08T19:18:41.280","lastModified":"2026-10-09T12:17:11.350","description":"An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU)","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-367"],"vendors":[],"products":[],"references":[{"url":"http://gnutls.com","tags":[]},{"url":"https://gist.github.com/lkloliver/6fbfc191bc6163942c8017551ac3f238","tags":[]},{"url":"https://gitlab.com/gnutls/gnutls/-/blob/3.8.13/lib/x509/verify.c#L1119-1178","tags":[]}],"exploitRefs":[{"url":"https://gist.github.com/lkloliver/6fbfc191bc6163942c8017551ac3f238","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows attackers to extract sensitive information by submitting X.509 certificates with conflicting Key Usage and Extended Key Usage settings that GnuTLS fails to properly validate. This creates a potential information disclosure vulnerability where attackers can bypass certificate validation checks.","exploitability":"Exploitation requires an attacker to submit a malicious X.509 certificate with contradictory KU/EKU values to a GnuTLS-based service, which is moderately difficult but achievable with access to certificate generation capabilities.","blast_radius":"If exploited, this vulnerability could allow attackers to extract sensitive information from systems using GnuTLS for certificate validation, potentially affecting web servers, email services, and other TLS-enabled applications.","remediation":"Upgrade to GnuTLS version 3.8.14 or later to address the certificate validation flaw.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["tls","certificate","information-disclosure"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:25:07.686Z"}}