Vulnerability record/PUBLISHED/Published Oct 8, 2026 00:00:00 UTC

CVE-2026-67693

An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU). NOTE: the Supplier does not consider this an actionable security vulnerability because of its "threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)" policy.

Base score3.7/ 10

SeverityLowCVSS 3.1

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityLow

Attack vectorNetworkAV

Attack complexityHighAC

Privileges requiredNonePR

User interactionNoneUI

ScopeUnchangedS

Confidentiality impactLowC

Integrity impactNoneI

Availability impactNoneA

CVSS vector stringCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering Authoritymitre

Last updatedNov 4, 2026 03:32:03 UTC

PublishedOct 8, 2026 00:00:00 UTC

ReservedJul 30, 2026 00:00:00 UTC