PT-2026-27303 · Gnutls+2 · Gnutls+2

Ireneusz Pastusiak · Published 2026-03-24 · Updated 2026-03-25 · CVE-2026-33308

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mod gnutls versions prior to 0.13.0

Description Mod gnutls, a TLS module for Apache HTTPD based on GnuTLS, had an issue where the code for client certificate verification did not validate the key purpose as defined in the Extended Key Usage extension. This could allow an attacker possessing the private key of a valid certificate, issued by a trusted CA for TLS client authentication but intended for a different purpose, to gain unauthorized access to resources requiring TLS client authentication. Server configurations not utilizing client certificates are not affected. The issue does not have a practical impact if dedicated Certificate Authorities (CAs) or sub-CAs are used solely for issuing TLS client certificates. The function gnutls certificate verify peers() is involved in the verification process.

Recommendations Versions prior to 0.13.0 should be updated to version 0.13.0 or later.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2026-33308

GHSA-HM2G-M958-8QGH

Affected Products

Apache Httpd

Gnutls

Mod-Gnutls

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33308.json · Exploit
• https://github.com/airtower-luna/mod_gnutls/security/advisories/GHSA-hm2g-m958-8qgh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33308 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33308 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33308 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33308 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33308 · Vendor Advisory
• https://twitter.com/CVEarity/status/2036848280521572717 · Twitter Post