CVE-2026-3832
Redhat Enterprise Linux 10.0 … 9.0
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NSummary
CVE-2026-3832 is a low-severity Incorrect Behavior Order: Early Validation (CWE-179) vulnerability in Redhat Enterprise Linux. Its CVSS base score is 3.7 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Subvert Trust Controls (T1553); ranked in the top 50% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-2 (Flaw Remediation) and IA-5 (Authenticator Management) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26402
Vulnerability Data
A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online Certificate Status Protocol (OCSP) response during a TLS handshake. Due to a logic error in how gnutls processes multi-record OCSP responses,…
more
a client with OCSP verification enabled may incorrectly accept a revoked server certificate, potentially leading to a compromise of trust.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Logic error bypasses OCSP revocation checks in TLS, directly enabling subverted certificate trust validation and adversary-in-the-middle attacks using revoked certs.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires applying patches to gnutls that correct the OCSP multi-record processing logic error so revoked certificates are no longer accepted.
Protects authenticity of TLS sessions by ensuring certificate validation (including OCSP revocation status) cannot be bypassed by crafted responses.
Requires proper management of certificates and revocation checking mechanisms so that OCSP responses are processed correctly before authentication succeeds.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
CWE-179 is a coding flaw enabling input-validation bypasses; it neither impairs post-incident forensic/root-cause processes (RS.AN-03) nor is itself mitigated or exposed by those processes.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect early-validation flaws but does not inherently prevent them in design.
Secure development life cycle mandates validation after canonicalization or sanitization, directly preventing early-validation bypasses.
Application security requirements include input validation rules that must be applied after protective transformations.
Secure architecture principles discourage unsafe ordering of validation and sanitization steps.
Secure coding standards explicitly require canonicalization before validation to avoid CWE-179.