CVE-2026-3833

Name of the Vulnerable Software and Affected Versions gnutls (affected versions not specified)

Description A flaw exists where case-sensitive comparisons are performed on nameConstraints labels, specifically for dNSName (DNS) or rfc822Name (email) constraints within excludedSubtrees or permittedSubtrees. A remote attacker can craft a leaf certificate with casing differences in the Subject Alternative Name (SAN) to bypass policies, causing a certificate that should be rejected to be accepted. This may lead to unauthorized access or information disclosure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.