Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-3832
Gnutls: gnutls: security bypass allows acceptance of revoked server certificates via crafted ocsp response
AV AC PR UI S C I A CVSS EPSS %ile KEV
N H N N U L N N 3.7 .0085 56.7 —
AFFECTED
Product Versions Fixed
gnutls unspecified —
Red Hat Enterprise Linux 10 unspecified 0:3.8.10-4.el10_2
Red Hat Enterprise Linux 10.0 Extended Update Support unspecified 0:3.8.9-9.el10_0.19
Red Hat Enterprise Linux 9 unspecified 0:3.8.10-4.el9_8
Red Hat Enterprise Linux 9 unspecified 0:3.8.10-4.el9_8
Cert Manager support for Red Hat OpenShift release 1.20 unspecified 1790598593
Red Hat Discovery 2 unspecified 1782159791
Red Hat Discovery 2 unspecified 1782166952
Red Hat Hardened Images unspecified 3.8.13-1.hum1
Red Hat Update Infrastructure 5 unspecified 1781525684
+ 12 more
TIMELINE
Mar 9 Reserved by redhat
Apr 30 Published (CNA: redhat)
Aug 21 EXPLOIT PUBLISHED — CVE-2026-3832 (gnutls). Public exploit reference added.
Aug 25 EXPLOIT PUBLISHED — CVE-2026-3832 (gnutls). Public exploit reference added.
Aug 31 EXPLOIT PUBLISHED — CVE-2026-3832 (gnutls). Public exploit reference added.
Sep 1 EXPLOIT PUBLISHED — CVE-2026-3832 (gnutls). Public exploit reference added.
Sep 29 EXPLOIT PUBLISHED — CVE-2026-3832 (gnutls). Public exploit reference added.
Description
A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online Certificate Status Protocol (OCSP) response during a TLS handshake. Due to a logic error in how gnutls processes multi-record OCSP responses, a client with OCSP verification enabled may incorrectly accept a revoked server certificate, potentially leading to a compromise of trust.
Lifecycle
Complete event history — 7 events, chronological
| Date | Event | Detail |
|---|
| March 9, 2026 | Reserved | Reserved by redhat |
| April 30, 2026 | Published | Published (CNA: redhat) |
| August 21, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-3832 (gnutls). Public exploit reference added. |
| August 25, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-3832 (gnutls). Public exploit reference added. |
| August 31, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-3832 (gnutls). Public exploit reference added. |
| September 1, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-3832 (gnutls). Public exploit reference added. |
| September 29, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-3832 (gnutls). Public exploit reference added. |
Affected
Affected products and packages — 22 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| — | gnutls | — | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | 0:3.8.10-4.el10_2 |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — | 0:3.8.9-9.el10_0.19 |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | 0:3.8.10-4.el9_8 |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | 0:3.8.10-4.el9_8 |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.20 | — | — | 1790598593 |
| Red Hat | Red Hat Discovery 2 | — | — | 1782159791 |
| Red Hat | Red Hat Discovery 2 | — | — | 1782166952 |
| Red Hat | Red Hat Hardened Images | — | — | 3.8.13-1.hum1 |
| Red Hat | Red Hat Update Infrastructure 5 | — | — | 1781525684 |
| Red Hat | Red Hat Update Infrastructure 5 | — | — | 1781525671 |
| Red Hat | Red Hat Update Infrastructure 5 | — | — | 1781525693 |
| Red Hat | Red Hat Update Infrastructure 5 | — | — | 1781525739 |
| Red Hat | Red Hat Update Infrastructure 5 | — | — | 1787241211 |
| Red Hat | Red Hat Update Infrastructure 5 | — | — | 1787135742 |
| Red Hat | Red Hat Update Infrastructure 5 | — | — | 1787241260 |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-3832 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
