CVE-2026-3832
LowCVSS 3.7Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
A logic flaw was found in GnuTLS when processing multi-record OCSP responses. A remote attacker can exploit this during a TLS handshake by sending a crafted OCSP response, causing a client with OCSP verification enabled to incorrectly accept a revoked server certificate.
Risk Assessment
The risk is bypassing certificate status verification, potentially allowing connections to servers with revoked certificates. This could compromise trust and enable an attacker to intercept communications.
Recommendation
Update GnuTLS to the latest patched version immediately. As a temporary measure, consider disabling OCSP verification only after thorough risk assessment.
Original NVD description (English source)
A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online Certificate Status Protocol (OCSP) response during a TLS handshake. Due to a logic error in how gnutls processes multi-record OCSP responses, a client with OCSP verification enabled may incorrectly accept a revoked server certificate, potentially leading to a compromise of trust.