CVE-2026-1584

A flaw was found in gnutls. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted ClientHello message with an invalid Pre-Shared Key (PSK) binder value during the TLS handshake. This can lead to a NULL pointer dereference, causing the server to crash and resulting in a remote Denial of Service (DoS) condition.

This IMPORTANT flaw in gnutls allows a remote, unauthenticated attacker to cause a Denial of Service. By sending a specially crafted ClientHello message with an invalid Pre-Shared Key (PSK) binder value, an attacker can trigger a NULL pointer dereference, leading to a crash of gnutls-based TLS servers configured to issue NewSessionTickets.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.