Cyber Resilience

CVE-2026-3833

Redhat Enterprise Linux 10.0 … 9.0

Public PoC
Published
30 April 2026
Modified
22 July 2026
Patch / advisory
CVSS Score v3.1 6.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS Score 0.0056 44th percentile
Risk Priority 52 floored blend · peak EPSS

Summary

CVE-2026-3833 is a medium-severity Improper Handling of Case Sensitivity (CWE-178) vulnerability in Redhat Enterprise Linux. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Masquerading (T1036); ranked at the 44th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-3 (Access Enforcement) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within `excludedSubtrees` or `permittedSubtrees`. A remote attacker can exploit this by crafting a leaf certificate…

more

with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1036 Masquerading Stealth
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-3832Same product: Gnu Gnutls
CVE-2026-42010Same product: Gnu Gnutls
CVE-2026-33845Same product: Gnu Gnutls
CVE-2025-32988Same product: Gnu Gnutls
CVE-2025-32990Same product: Gnu Gnutls
CVE-2025-32989Same product: Gnu Gnutls
CVE-2026-6846Same product: Redhat Enterprise Linux
CVE-2026-15573Same vendor: Redhat
CVE-2026-6844Same product: Redhat Enterprise Linux
CVE-2026-6845Same product: Redhat Enterprise Linux

Affected Assets

gnu
gnutls
all versions
redhat
hardened images
all versions
redhat
openshift container platform
4.0
redhat
enterprise linux
10.0, 6.0, 7.0, 8.0, 9.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

Applying access control decisions to each request depends on accurate property determination that accounts for case differences.

Correct enforcement of authorizations for resource access structurally requires consistent case-sensitive handling of identifiers to avoid incorrect decisions.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 partial match
prevents

Secure SDLC practices can catch and prevent case-sensitivity flaws during code review or testing, but fixing one CWE achieves negligible coverage of the broad control.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Secure SDLC practices should include case-sensitivity requirements in design and coding standards.

prevents

Application security requirements must specify case handling for identifiers and paths.

prevents

Architecture principles should enforce canonical, case-aware resource naming.

prevents

Secure coding guidelines must mandate explicit case handling to prevent inconsistent lookups.

degrades

Access-control rules that ignore case can allow unintended resource access.

degrades

Authentication logic must treat identifiers consistently to avoid bypass via case differences.

References