CVE-2026-95210: 
GnuTLS vulnerability analysis and mitigation

CVE-2026-95210 is an improper certificate validation vulnerability (CWE-295) in GnuTLS v3.8.13 that causes the library to accept end-entity certificates containing structurally invalid critical extensions. Specifically, GnuTLS accepts a certificate whose critical keyUsage extension value is an ASN.1 NULL (05 00) instead of the RFC 5280-required BIT STRING, allowing the certificate to pass path validation while later use of the same extension fails with a parse error. The vulnerability was published on October 8, 2026, and carries a CVSS v3.1 base score of 9.1 (Critical) (Github Advisory, Feedly).

The root cause is a logic flaw in GnuTLS's certificate path validation: check_for_unknown_exts() in lib/x509/verify.c uses an OID-only allow-list (is_ext_oid_supported()) to gate critical extensions, never parsing the extension values themselves. Because extension values are decoded lazily by accessor APIs, and verify_crt() never invokes any extension accessor on the end-entity certificate during path validation, a critical keyUsage extension with a malformed extnValue (ASN.1 NULL, DER: 55 1d 0f 01 01 ff 04 02 05 00) passes validation undetected. The function gnutls_x509_ext_import_key_usage() — which would reject the malformed value — is only called on issuer certificates (for keyCertSign/crlSign checks), never on the leaf. This creates a verify-accepts/use-time-error semantic split: certtool --verify reports the certificate as trusted, while gnutls_x509_crt_get_key_usage() returns -73 (GNUTLS_E_ASN1_TAG_ERROR). A public PoC with crafted certificate files and a reproducible test program is available (Researcher Gist, PoC Repository).

Successful exploitation allows an unauthenticated network attacker to present a malformed certificate that GnuTLS accepts as trusted, enabling man-in-the-middle (MITM) attacks to intercept and decrypt TLS-encrypted communications or impersonate legitimate services. Confidentiality and integrity are both rated High, as an attacker can read and modify traffic protected by TLS sessions validated through the vulnerable library. Applications that rely on GnuTLS to enforce key-usage policy are particularly at risk, since the library accepts the certificate while any subsequent application-level key-usage check will receive a parse error rather than a meaningful policy decision (Github Advisory, Researcher Gist).

A public proof-of-concept exploit is available on GitHub, including crafted certificate files (kn_crit_ca.pem, kn_crit_leaf.pem) and a compilable C test program demonstrating the verify-accepts/use-time-error split (PoC Repository). The vulnerability is exploitable without authentication or user interaction over the network, and Feedly's NVD SSVC assessment classifies it as automatable with a PoC exploitation status. The EPSS score is approximately 0.228%, and there is no current evidence of in-the-wild exploitation or CISA KEV catalog inclusion (Github Advisory, Feedly). The vulnerability shares its root cause with CVE-2026-67693, which involves a structurally valid but empty BIT STRING accepted by the same flawed validation path (PoC Repository).

1. Craft malformed certificate: Create an end-entity X.509 certificate (kn_crit_leaf.pem) with a critical keyUsage extension (OID 2.5.29.15) whose extnValue is an OCTET STRING wrapping ASN.1 NULL (DER: 55 1d 0f 01 01 ff 04 02 05 00) instead of a BIT STRING as required by RFC 5280. Pair it with a normal root CA certificate (kn_crit_ca.pem).
2. Verify bypass: Confirm the malformed certificate passes GnuTLS validation using certtool --verify --load-ca-certificate kn_crit_ca.pem --infile kn_crit_leaf.pem. Expected output: Verified. The certificate is trusted.
3. Confirm use-time error: Compile and run the provided test program (test_gnu_getku.c) against the leaf certificate. The call to gnutls_x509_crt_get_key_usage() returns -73 (GNUTLS_E_ASN1_TAG_ERROR), confirming the semantic split.
4. Deploy in MITM position: Position the attacker between a GnuTLS client and a legitimate server (e.g., via ARP spoofing, DNS poisoning, or BGP hijacking). Present the malformed certificate during the TLS handshake.
5. Achieve traffic interception: Because GnuTLS accepts the malformed certificate as trusted, the TLS handshake completes successfully. The attacker can decrypt, read, and modify traffic between the client and the intended server, or fully impersonate the legitimate service (PoC Repository, Researcher Gist).

• Network: Unexpected TLS certificates presented during handshakes with a critical keyUsage extension whose DER value is 55 1d 0f 01 01 ff 04 02 05 00 (OCTET STRING wrapping ASN.1 NULL); TLS connections to known-good servers originating from unexpected intermediate IPs suggesting MITM positioning.
• Logs: Application logs showing GNUTLS_E_ASN1_TAG_ERROR (-73) errors when accessing key-usage fields of certificates that were previously accepted as trusted; GnuTLS verification logs reporting success for certificates that other libraries (e.g., OpenSSL) reject.
• File System: Presence of crafted certificate files (kn_crit_leaf.pem, kn_crit_ca.pem) or test binaries (test_gnu_getku) associated with the public PoC on systems where they should not exist.
• Process: Unexpected certtool invocations or GnuTLS-linked processes performing certificate verification against unusual CA bundles (PoC Repository, Researcher Gist).

The primary remediation is to update GnuTLS to a patched version that properly validates critical extension values during path validation, not just their OIDs. Until a patch is applied, consider implementing certificate pinning at the application level to prevent acceptance of unexpected certificates. Applications using GnuTLS should also enforce strict certificate checking and, where feasible, add application-level validation of key-usage extensions as a defense-in-depth measure. The Warpgate project has already issued a dependency update pull request in response to this vulnerability (Warpgate PR, Github Advisory).

The vulnerability was noted in the context of Microsoft's October 2026 Patch Tuesday, which addressed over 1,400 flaws, giving it some broader media visibility (BleepingComputer). The Warpgate open-source project promptly issued a pull request to update its GnuTLS dependency in response to the disclosure (Warpgate PR). The discoverer, Kailin Liu, published a detailed technical gist and PoC repository explaining the verify-accepts/use-time-error semantic split and its relationship to the related CVE-2026-67693 (Researcher Gist).