{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-95210", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-10-19T15:13:43.177Z", "dateReserved": "2026-09-22T00:00:00.000Z", "datePublished": "2026-10-08T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-08T18:02:34.490Z"}, "descriptions": [{"lang": "en", "value": "Improper certificate validation in gnutls v3.8.13 causes the application to accept certificates containing invalid extensions."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "http://gnutls.com"}, {"url": "https://gist.github.com/lkloliver/4aad23689202720c4068f43b3c6069c7"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-295", "lang": "en", "description": "CWE-295 Improper Certificate Validation"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-19T15:13:40.091042Z", "id": "CVE-2026-95210", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T15:13:43.177Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-95210", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-19T15:13:40.091042Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295 Improper Certificate Validation"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-08T18:28:04.253Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "http://gnutls.com"}, {"url": "https://gist.github.com/lkloliver/4aad23689202720c4068f43b3c6069c7"}], "descriptions": [{"lang": "en", "value": "Improper certificate validation in gnutls v3.8.13 causes the application to accept certificates containing invalid extensions."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-08T18:02:34.490Z"}}}, "cveMetadata": {"cveId": "CVE-2026-95210", "state": "PUBLISHED", "dateUpdated": "2026-10-19T15:13:43.177Z", "dateReserved": "2026-09-22T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-10-08T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper certificate validation in gnutls v3.8.13 causes the application to accept certificates containing invalid extensions."}], "id": "CVE-2026-95210", "lastModified": "2026-10-19T16:17:09.577", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 2.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-95210", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-19T15:13:40.091042Z", "version": "2.0.3"}}]}, "published": "2026-10-08T18:18:33.370", "references": [{"source": "cve@mitre.org", "url": "http://gnutls.com"}, {"source": "cve@mitre.org", "url": "https://gist.github.com/lkloliver/4aad23689202720c4068f43b3c6069c7"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "gnutls: gnutls: certificates with invalid extensions incorrectly accepted", "id": "2548142", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548142"}, "csaw": false, "cwe": "CWE-295", "details": ["Improper certificate validation in gnutls v3.8.13 causes the application to accept certificates containing invalid extensions.", "A flaw was found in GnuTLS. Improper certificate validation causes the library to accept certificates containing invalid extensions. A remote attacker could exploit this flaw by presenting a specially crafted certificate during a secure connection. Successful exploitation may allow an attacker to bypass certificate validation checks and undermine the integrity of secure communications."], "name": "CVE-2026-95210", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "gnutls", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-10-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-95210\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-95210\nhttp://gnutls.com\nhttps://gist.github.com/lkloliver/4aad23689202720c4068f43b3c6069c7"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.8.13"}}], "enrichment": {"confidence": 87.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 87.0, "source": "matching"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "gnutls", "vendor": "gnu"}], "created": "2026-10-08T20:15:06.449896+00:00", "title": "Certificate Validation Bypass due to Invalid Extensions", "updated": "2026-10-19T18:45:02.023106+00:00", "vendors": ["gnu", "gnu$PRODUCT$gnutls"]}