CVE-2026-1584 Gnutls: gnutls: remote denial of service via crafted clienthello with invalid psk binder
Remote attackers can crash TLS servers by sending crafted ClientHello messages with invalid PSK binders, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-1584?
CVE-2026-1584 is a high-severity vulnerability in Gnu Gnutls, published on 9 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in gnutls. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted ClientHello message with an invalid Pre-Shared Key (PSK) binder value during the TLS handshake. This can lead to a NULL pointer dereference, causing the server to crash and resulting in a remote Denial of Service (DoS) condition.
Weakness: CWE-476
Which versions are affected by CVE-2026-1584?
It affects 2 products.
Products include Gnu Gnutls, Redhat Hardened Images.
How do I fix CVE-2026-1584?
Apply the vendor's patch.
Is CVE-2026-1584 being exploited?
There is no known exploitation of CVE-2026-1584 in the wild and no public exploit code.
Other vulnerabilities in Gnu Gnutls
Sources
Also known as ALPINE-CVE-2026-1584, BELL-CVE-2026-1584, DEBIAN-CVE-2026-1584, GHSA-92xv-mw29-x4px.