Not scored
CVE-2026-1584
Gnutls: gnutls: remote denial of service via crafted clienthello with invalid psk binder
Red HatRed Hat Hardened Images
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 25 Oct
1.3%probability of exploitation in the next 30 days
Higher than 71% of scored CVEs
SeverityCVSS
–Not scored yet
Description NVD
A flaw was found in gnutls. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted ClientHello message with an invalid Pre-Shared Key (PSK) binder value during the TLS handshake. This can lead to a NULL pointer dereference, causing the server to crash and resulting in a remote Denial of Service (DoS) condition.
Coverage 1 article · 1 outlet
- Handshake Halt: GnuTLS 3.8.12 Fixes TLS 1.3 Crash & CPU ExhaustionSecurityOnline · first in our coverage