Description

An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-10-08T19:18:41.280Z",
  "pubdate": "2026-10-08T19:18:41.280Z",
  "executiveSummary": "A critical validation logic flaw exists in GnuTLS v.3.8.13 involving the improper handling of contradictory X.509 certificate attributes. The vulnerability centers on the library's failure to reject end-entity certificates that present mutually exclusive or conflicting combinations of Key Usage (KU) and Extended Key Usage (EKU) extensions.\nThis vulnerability is classified as an improper certificate validation issue. By exploiting this discrepancy, a malicious actor can circumvent standard certificate role constraints, allowing an attacker to present a certificate for a purpose for which it was not intended or authorized. The impact includes the potential for sensitive information disclosure, unauthorized authentication, or man-in-the-middle (MitM) scenarios where identity verification mechanisms are weakened.\nThe flaw affects systems utilizing GnuTLS v.3.8.13 for TLS/SSL handshake validation. Successful exploitation requires an attacker to possess or control a forged or improperly issued certificate containing specific conflicting attribute parameters. No specialized authentication is required; the vulnerability is exposed during the standard certificate chain validation process performed by the GnuTLS library when a client or server attempts to establish a secure connection.",
  "technicalDetails": "The root cause of this vulnerability lies in the GnuTLS X.509 certificate verification logic, which fails to enforce strict consistency requirements when parsing conflicting Key Usage (KU) and Extended Key Usage (EKU) extensions within an end-entity certificate. The X.509 standard dictates that if multiple extensions are present that constrain the use of a key, the implementation must ensure that the certificate is only used if the intended operation is permitted by all extensions. In GnuTLS v.3.8.13, the verification engine does not appropriately reject certificates where the defined KU bitmask directly contradicts or invalidates the EKU purpose specified for the certificate session.\nThe attack flow initiates when an attacker presents a specially crafted X.509 certificate to an application using the vulnerable GnuTLS version. This certificate is structured to contain a Key Usage extension that restricts the key to a limited function (e.g., Digital Signature) while simultaneously including an Extended Key Usage extension for a different, potentially privileged operation (e.g., Server Authentication). Under normal operation, the GnuTLS validation function should reconcile these extensions and reject the certificate if the constraints are non-intersecting or logically contradictory. Because the library fails to perform this validation, the certificate is incorrectly accepted as valid for the desired operation.\nThe exploitation process involves the following steps: 1) The attacker constructs a malicious X.509 certificate with contradictory KU and EKU extensions. 2) The attacker initiates a TLS/SSL handshake with a target service using GnuTLS v.3.8.13. 3) During the handshake, GnuTLS performs certificate verification. 4) The library's verification function evaluates the KU/EKU extensions but fails to identify the conflict, incorrectly flagging the certificate as cryptographically sound and authorized for the connection context. 5) The library proceeds to complete the handshake, granting the attacker the identity or permissions associated with the misused EKU.\nThis vulnerability leads to post-exploitation impacts including information disclosure, as the attacker can bypass intended security policies regarding key usage. The failure to enforce certificate constraints undermines the integrity of the Public Key Infrastructure (PKI) ecosystem upon which the TLS implementation relies, effectively allowing the circumvention of fine-grained access control enforced via certificate extensions."
}