CVE-2026-67693

A flaw was found in GnuTLS. The certificate verification process fails to properly reject end-entity digital certificates containing contradictory Key Usage (KU) and Extended Key Usage (EKU) extensions, which define the permitted cryptographic operations of a certificate. A remote attacker could exploit this flaw by presenting a specially crafted certificate to bypass validation controls, potentially resulting in information disclosure.

This vulnerability is rated as Moderate impact because successful exploitation requires an attacker to present a certificate that conforms to an established trust chain, without granting remote code execution or complete session subversion. Applications relying on GnuTLS across Red Hat Enterprise Linux and OpenShift process certificates according to configured trust stores, limiting exposure to environments where a trusted authority issues conflicting usage extensions. Consequently, the flaw primarily exposes cryptographic operations to misuse rather than granting direct unauthorized system access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.