CVE-2026-33308 impacts mod_gnutls, a TLS module for Apache HTTPD, prior to version 0.13.0, due to insufficient validation of client certificate Extended Key Usage extensions. This flaw could allow an attacker with a valid private key for a certificate issued by a trusted CA, but designated for a different purpose, to bypass client authentication on affected servers. Rated Medium with a CVSS score of 5.9, the vulnerability has a network attack vector and high attack complexity, potentially leading to high confidentiality impact. There is no evidence of active exploitation, public exploit code, or significant community attention, and it is not listed on CISA's KEV catalog. The issue is resolved in version 0.13.0 by enforcing proper key purpose checks.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 0.13.0CPE matchmatch criteria | cpe:2.3:a:mod_gnutls_project:mod_gnutls:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
mod_gnutls Multiple Vulnerabilities
Mar 20, 2026mod_gnutls Multiple Vulnerabilities
Mar 20, 2026mod_gnutls Multiple Vulnerabilities
Mar 20, 2026mod_gnutls Multiple Vulnerabilities
Mar 20, 2026mod_gnutls Multiple Vulnerabilities
Mar 20, 2026