GnuTLS CVE-2026-1584: Brief Summary of a NULL Pointer Dereference in TLS 1.3 PSK Binder Verification

Introduction

A single malformed TLS handshake message can crash any GnuTLS 3.8.11 server that issues session tickets, which makes this a trivially exploitable remote denial of service. CVE-2026-1584 is a NULL pointer dereference in GnuTLS's PSK binder verification logic during TLS 1.3 resumption. It has a CVSS v3 base score of 7.5 (High), and the attack is network-based and needs no authentication and no user interaction.

GnuTLS is a free software implementation of the TLS, SSL, and DTLS protocols, with a core cryptographic API for secure network communication. It ships in many Linux distributions, including Debian, Ubuntu, Fedora, Alpine, and openSUSE. Because it is so widely used, a regression in GnuTLS can reach a large part of the Linux server ecosystem.

Technical Information

Root Cause

The vulnerability is classified as CWE-476 (NULL Pointer Dereference). It is a regression introduced in GnuTLS 3.8.11 by merge requests !2009 and !2013, which added a configurable binder algorithm for PSK credentials. The faulty code is in the server-side TLS 1.3 PSK binder verification logic in lib/ext/pre_shared_key.c.

When a GnuTLS server issues a NewSessionTicket and a client later sends a ClientHello that references that ticket identity for session resumption, the function _gnutls_psk_recv_params() calls _gnutls_get_cred() to fetch PSK credentials. In ticket resumption, the returned pskcred pointer is NULL, because the server has no standalone PSK credentials configured. A conditional check returned early when pskcred was NULL and GNUTLS_NO_TICKETS was also set, but the ticket-based resumption path still passed the NULL pskcred pointer into server_recv_params().

The Crash Condition

The crash needs a specific but easily reproduced condition. The client sends an invalid PSK binder whose size matches the PRF MAC length but whose value is wrong. In that case the server does not exit early, and the code goes on to dereference pskcred->binder_algo to check the binder algorithm. Because pskcred is NULL, this is a classic NULL pointer dereference, and it crashes the server process immediately with a segmentation fault (SIGSEGV).

Attack Flow

The exploitation sequence is straightforward:

1. The attacker initiates a TLS 1.3 connection to a vulnerable GnuTLS server and completes a normal handshake to receive a NewSessionTicket.
2. The attacker then sends a new ClientHello that references that ticket identity but carries a deliberately corrupted PSK binder value. The binder must have the correct size (matching the PRF MAC length) but incorrect content.
3. The server enters the PSK binder verification code path. Because this is a ticket-based resumption, _gnutls_get_cred() returns NULL for pskcred.
4. The binder size check passes (the sizes match), so the code does not exit early.
5. The code tries to access pskcred->binder_algo and dereferences the NULL pointer.
6. The server process terminates with a segmentation fault.

The crash does not depend on any particular priority string configuration. The vulnerable path is part of the server-side PSK binder handling and is reachable whenever the server issues a NewSessionTicket. The maintainers confirmed that a standard server configuration reliably segfaults on version 3.8.11 and that version 3.8.10 is unaffected.

The CVSS vector describes a network-based, low-complexity attack that needs no privileges and no user interaction. The impact is limited to availability, with no effect on confidentiality or integrity.

Patch Information

The GnuTLS project fixed CVE-2026-1584 in commit acf67a4a, written by Alexander Sosedkin. The fix shipped in GnuTLS 3.8.12, released on February 9, 2026. It is tracked under security advisory GNUTLS-SA-2026-02-09-1 and was coordinated through GitLab issue #1790, which Jaehun Lee originally reported.

The fix is a single-line guard added to lib/ext/pre_shared_key.c around line 986:

- if (pskcred->binder_algo == NULL && mac == GNUTLS_MAC_SHA384) {
+ if (pskcred && pskcred->binder_algo == NULL &&
+     mac == GNUTLS_MAC_SHA384) {

The new pskcred NULL check runs before the code touches pskcred->binder_algo, so the binder algorithm retry logic is skipped when no PSK credential structure exists. When pskcred is NULL, the conditional evaluates to false and the code falls through to return GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER. An invalid binder now gets the correct error instead of a crash.

Versions 3.8.10 and earlier are not affected, because the regression first appeared in the 3.8.11 release. Users should upgrade to GnuTLS 3.8.12 or later. The official advisories document no workaround or configuration change that prevents the crash without the patch.

Detection Methods

Vulnerability Scanner Coverage (Nessus)

Tenable has published three Nessus plugins that detect systems running vulnerable GnuTLS packages:

• Plugin 298449 (unpatched_CVE_2026_1584.nasl): Published February 10, 2026. A local check for unpatched gnutls28 packages on Ubuntu Linux systems (16.04 LTS through 25.10). It runs through Nessus Agent, Agentless Assessment, or Frictionless Assessment (AWS/Azure), and it needs the Host/local_checks_enabled and global_settings/vendor_unpatched KB items set on the host.
• Plugin 298695: Also added on February 10, 2026, for additional platforms.
• Plugin 299149: Added on February 16, 2026, covering more distributions.

Organizations using Tenable Nessus, Tenable.io, or Tenable.sc should make sure their plugin feeds are updated to at least March 2026 so they pick up all three detection plugins.

Version-Based Detection and Package Auditing

The affected version window is narrow. Only GnuTLS version 3.8.11 carries the vulnerable code path, and defenders can audit installed versions with standard package managers:

• On Debian/Ubuntu-based systems, check the installed version of the libgnutls30 or gnutls28 package.
• On Slackware systems, the fix was delivered as gnutls-3.8.12-i586-1_slack15.0.txz (SSA:2026-042-01), and the advisory publishes MD5 checksums to verify package integrity.
• CPE identifiers for matching in asset inventories include p-cpe:/a:canonical:ubuntu_linux:gnutls28 and the corresponding entries for other distributions.

Red Hat's advisory lists most RHEL versions (6 through 10) and OpenShift Container Platform 4 as "Not affected" because their shipped versions do not contain the vulnerable code. Red Hat Hardened Images are listed as "Affected," so users of those images should check their GnuTLS version.

Behavioral Detection and Log Monitoring

Because a malformed TLS 1.3 ClientHello with an invalid PSK binder crashes the server through a NULL pointer dereference, exploitation leaves symptoms that defenders can monitor:

• Process crash logs: GnuTLS-based TLS server processes crash abruptly. Look for segmentation faults (SIGSEGV) or abnormal termination signals in system logs (/var/log/syslog, journalctl, or application-specific crash logs) that line up with TLS handshake activity.
• Core dumps: If core dumps are enabled, the backtrace points to the PSK binder verification code path during TLS 1.3 resumption handling.
• Connection pattern anomalies: Repeated, short-lived TLS connection attempts that fail during the handshake, especially against services known to issue NewSessionTicket messages, could reveal exploitation attempts. Repeated server restarts or high-availability failovers after TLS handshake attempts are strong indicators.

Network Level Detection (Snort)

A Snort Subscriber Rules update published on March 3, 2026 added and modified rules in several categories, including the server-webapp rule set. The update announcement does not list specific Snort SIDs for CVE-2026-1584, but the timing and scope of the update line up with the vulnerability's disclosure window. Organizations running Snort with an active subscriber ruleset should be on rules updated to at least March 2026.

Affected Systems and Versions

The vulnerability is a regression with a narrow affected window:

• Affected: GnuTLS version 3.8.11 only
• Not affected: GnuTLS versions 3.8.10 and earlier
• Fixed in: GnuTLS version 3.8.12

Distribution-specific status:

Organizations running rolling-release distributions or custom-compiled builds of GnuTLS 3.8.11 are the ones who most need to patch immediately.

Vendor Security History

GnuTLS has a strong security track record. The project runs a public security page that tracks vulnerabilities, and its stated policy is that no known vulnerability stays unpatched for more than 60 days. For CVE-2026-1584, the maintainers responded promptly to Jaehun Lee's private disclosure, verified the regression, assigned a CVE, and shipped the fix in the next point release. GnuTLS 3.8.12 also fixed a second vulnerability, CVE-2025-14831, as noted in the oss-security announcement.

References

• NVD: CVE-2026-1584
• Red Hat Security Advisory: CVE-2026-1584
• Red Hat Bugzilla: Bug 2435258
• GitLab Issue #1790: NULL pointer dereference in PSK binder verification
• GitLab Commit acf67a4a: Fix for CVE-2026-1584
• GnuTLS Security Advisories
• oss-security: gnutls 3.8.12 fixes CVE-2026-1584 and CVE-2025-14831
• GnuTLS NEWS file
• oss-sec Mailing List: gnutls 3.8.12 announcement
• Ubuntu Security: CVE-2026-1584
• Amazon Linux Security: CVE-2026-1584
• Alpine Security Tracker: CVE-2026-1584
• SUSE Security: CVE-2026-1584
• Tenable Nessus Plugin 298449
• Tenable CVE Page: CVE-2026-1584
• Feedly CVE Timeline: CVE-2026-1584
• GnuTLS Help Mailing List: February 2026
• Slackware Advisory: gnutls SSA:2026-042-01
• Snort Subscriber Rules Update: Q1 2026