VulnSocial

CVE-2026-1584Disclosure(gnu / gnutls)

LOWCVSS 7.5 · HIGH

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Patch gnu gnutls systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw was found in gnutls. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted ClientHello message with an invalid Pre-Shared Key (PSK) binder value during the TLS handshake. This can lead to a NULL pointer dereference, causing the server to crash and resulting in a remote Denial of Service (DoS) condition.

gnu CVEsBack to dashboard
1.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-476

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • gnutls
  • hardened_images

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • 3 total mentions across 1 day

Affected systems

Vendors
gnuredhat
Products
gnutlshardened_images

1 version affected across 2 products

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-02-10: 3Patch / Workaround · 2026-02-10: 1Technical Details · 2026-02-10: 302-10
Signal classification2 categories
Disclosure
266.7%
Patch
133.3%
Referenced assets2 URLs
Full discourse3 posts
  • Open Source Security mailing list@oss_security
    Patch

    GnuTLS 3.8.12 fixes 2 CVEs https://www.openwall.com/lists/oss-security/2026/02/09/6 CVE-2026-1584: NULL pointer dereference in PSK binder verification (TLS 1.3 resumption attempt with an invalid PSK binder value in ClientHello could lead to DoS) CVE-2025-14831: Name constraint processing performance issue

    Post summary

    The text announces that GnuTLS 3.8.12 includes patches for CVE-2026-1584 and CVE-2025-14831, providing brief technical details but no proof‑of‑concept or exploit code.

    12051786
    4.4K followersView on X
  • transilienceai@transilienceai
    Disclosure

    @oss_security CVE-2026-1584: NULL Pointer Dereference in PSK Binder Verification. It affects TLS 1.3 resumption attempts and is triggered when an invalid PSK binder value is included in the ClientHello message. Impact: Denial of Service (DoS). ⚠️ #Vulnerability

    Post summary

    The post announces CVE-2026-1584, a NULL pointer dereference in TLS 1.3 PSK binder verification leading to DoS, but offers no evidence of exploitation or remediation.

    1000045
    315 followersView on X
  • Autumn Good@autumn_good_35
    Disclosure

    GNUTLS-SA-2026-02-09-1、CVE-2026-1584 Severity High; invalid pointer access GNUTLS-SA-2026-02-09-2、CVE-2025-14831 Severity Medium; denial of service The GnuTLS Transport Layer Security Library https://www.gnutls.org/security-new.html

    Post summary

    The passage announces two new GnuTLS CVEs, providing severity and basic technical details, and points to the official security page for more information.

    00000512
    6.7K followersView on X
CPE platform detail2 entries

2 of 2 entries

PartVendorProductVersionTarget SWTarget HW
Appgnugnutls---
Appredhathardened_images---

Explore more

Back to dashboardgnu CVEsredhat CVEsgnutls vulnerabilities