{"id":"CVE-2026-95209","published":"2026-10-08T19:20:52.830","lastModified":"2026-10-08T21:33:42.423","description":"An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of Service (DoS).","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-400"],"vendors":[],"products":[],"references":[{"url":"http://gnutls.com","tags":[]},{"url":"https://evil.com","tags":[]},{"url":"https://gist.github.com/lkloliver/8e4498311aff18e2077010e412043e18","tags":[]}],"exploitRefs":[{"url":"https://gist.github.com/lkloliver/8e4498311aff18e2077010e412043e18","tags":[]}],"hasPoc":true,"ai":{"summary":"A flaw in gnutls v3.8.13 causes legitimate CA certificates to be incorrectly rejected, leading to denial of service when TLS connections fail. This affects systems that rely on certificate validation for secure communications.","exploitability":"Exploitation is relatively straightforward as it requires only sending a malformed certificate to trigger the DoS condition, with no authentication or user interaction required.","blast_radius":"The impact could be significant across any system using gnutls v3.8.13 for TLS certificate validation, potentially affecting web servers, email services, and other applications that depend on secure connections.","remediation":"Upgrade to gnutls 3.8.14 or later to resolve the CA certificate rejection issue.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["tls","dos","certificate"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:24:55.789Z"}}