CVE-2026-67693

Summary

The flaw allows attackers to extract sensitive information by submitting X.509 certificates with conflicting Key Usage and Extended Key Usage settings that GnuTLS fails to properly validate. This creates a potential information disclosure vulnerability where attackers can bypass certificate validation checks.

Exploitability

Exploitation requires an attacker to submit a malicious X.509 certificate with contradictory KU/EKU values to a GnuTLS-based service, which is moderately difficult but achievable with access to certificate generation capabilities.

Blast radius

If exploited, this vulnerability could allow attackers to extract sensitive information from systems using GnuTLS for certificate validation, potentially affecting web servers, email services, and other TLS-enabled applications.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to GnuTLS version 3.8.14 or later to address the certificate validation flaw.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.