Cyber Resilience

CVE-2026-3832

Redhat Enterprise Linux 10.0 … 9.0

Public PoC
Published
30 April 2026
Modified
25 August 2026
Patch / advisory
View advisory
CVSS Score v3.1 3.7
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.0074 52th percentile
Risk Priority 34 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-3832 is a low-severity Incorrect Behavior Order: Early Validation (CWE-179) vulnerability in Redhat Enterprise Linux. Its CVSS base score is 3.7 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 48% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online Certificate Status Protocol (OCSP) response during a TLS handshake. Due to a logic error in how gnutls processes multi-record OCSP responses,…

more

a client with OCSP verification enabled may incorrectly accept a revoked server certificate, potentially leading to a compromise of trust.

CWE(s)
CWE-179

Related Threats

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-42010Same product: Gnu Gnutls
CVE-2026-3833Same product: Gnu Gnutls
CVE-2026-33845Same product: Gnu Gnutls
CVE-2025-32990Same product: Gnu Gnutls
CVE-2025-32988Same product: Gnu Gnutls
CVE-2026-6846Same product: Redhat Enterprise Linux
CVE-2025-32989Same product: Gnu Gnutls
CVE-2025-0678Same product: Redhat Enterprise Linux
CVE-2026-6843Same product: Redhat Enterprise Linux
CVE-2024-45778Same product: Redhat Enterprise Linux

Affected Assets

gnu
gnutls
all versions
redhat
hardened images
all versions
redhat
openshift container platform
4.0
redhat
enterprise linux
10.0, 6.0, 7.0, 8.0, 9.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V1.3.6
  • V1.3.8
  • V2.2.1
  • V3.7.2

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match

Requiring validation of information inputs after canonicalization or sanitization directly stops the incorrect ordering that lets modified dangerous data bypass checks.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

RS.AN-03 none match
degrades

CWE-179 is a coding flaw enabling input-validation bypasses; it neither impairs post-incident forensic/root-cause processes (RS.AN-03) nor is itself mitigated or exposed by those processes.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect early-validation flaws but does not inherently prevent them in design.

A.8.25 Secure development life cycle partial match
prevents

Secure development life cycle mandates validation after canonicalization or sanitization, directly preventing early-validation bypasses.

A.8.26 Application security requirements partial match
prevents

Application security requirements include input validation rules that must be applied after protective transformations.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles discourage unsafe ordering of validation and sanitization steps.

A.8.28 Secure coding partial match
prevents

Secure coding standards explicitly require canonicalization before validation to avoid CWE-179.

References