Summaryinfo

A vulnerability, which was classified as critical, was found in airtower-luna mod_gnutls up to 0.12.x on Apache. This affects the function gnutls_certificate_verify_peers of the component TLS Module. The manipulation results in certificate validation. This vulnerability is reported as CVE-2026-33308. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in airtower-luna mod_gnutls up to 0.12.x on Apache. It has been classified as problematic. Affected is the function gnutls_certificate_verify_peers of the component TLS Module. The manipulation with an unknown input leads to a certificate validation vulnerability. CWE is classifying the issue as CWE-295. The product does not validate, or incorrectly validates, a certificate. This is going to have an impact on integrity. CVE summarizes:

Mod_gnutls is a TLS module for Apache HTTPD based on GnuTLS. Prior to version 0.13.0, code for client certificate verification did not check the key purpose as set in the Extended Key Usage extension. An attacker with access to the private key for a valid certificate issued by a CA trusted for TLS client authentication but designated for a different purpose could have used that certificate to improperly access resources requiring TLS client authentication. Server configurations that do not use client certificates (`GnuTLSClientVerify ignore`, the default) are not affected. The problem has been fixed in version 0.13.0 by rewriting certificate verification to use `gnutls_certificate_verify_peers()`, and requiring key purpose id-kp-clientAuth (also known as `tls_www_client` in GnuTLS) by default if the Extended Key Usage extension is present. The new `GnuTLSClientKeyPurpose` option allows overriding the expected key purpose if needed (please see the manual for details). Behavior for certificates without an Extended Key Usage extension is unchanged. If dedicated (sub-)CAs are used for issuing TLS client certificates only (not for any other purposes) the issue has no practical impact.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-33308 since 03/18/2026. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1587.003 by the MITRE ATT&CK project.

The vulnerability scanner Nessus provides a plugin with the ID 304096 (Linux Distros Unpatched Vulnerability : CVE-2026-33308), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.13.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (304096). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Network Encryption Software

Vendor

• airtower-luna

Name

• mod_gnutls

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12

Website

• Product: https://github.com/airtower-luna/mod_gnutls/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion