What is GHSA-2j2x-fffq-ff4q?

GHSA-2j2x-fffq-ff4q is a security advisory published by GitHub Security Advisories with Critical severity. A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name...

Which CVE IDs does GHSA-2j2x-fffq-ff4q cover?

GHSA-2j2x-fffq-ff4q covers the following CVE IDs: CVE-2026-88647. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2j2x-fffq-ff4q?

GHSA-2j2x-fffq-ff4q has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

GHSA-2j2x-fffq-ff4qCriticalCVSS 9.1

A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name...

Vendor

GitHub Security Advisories

Published

October 8, 2026

Last Modified

November 4, 2026

🔗 CVE IDs covered (1)

CVE-2026-88647 →

📋 Description

A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certificate.

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2026-88647
https://gist.github.com/lkloliver/f98ec3de1a871fdfc02b70b8b9ba7642
https://gitlab.com/gnutls/gnutls/-/issues/1802
https://github.com/lkloliver/poc/tree/main/CVE-2026-88647
https://gitlab.com/gnutls/gnutls/-/blob/e2169a87c7fb91935c2845088204b102baed4c5f/SECURITY.md
https://gitlab.com/gnutls/gnutls/-/work_items/1965
https://github.com/advisories/GHSA-2j2x-fffq-ff4q