---
title: "CVE-2026-33307\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2026-33307?format=md
keywords: index, follow
---

# CVE-2026-33307

Publication date 24 March 2026

Last updated 1 April 2026

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

## Cvss 3 Severity Score

**7.5 · High**

[Score breakdown](https://ubuntu.com/security/CVE-2026-33307?format=md#impact-score)

Toggle side navigation

## Description

Mod\_gnutls is a TLS module for Apache HTTPD based on GnuTLS. In versions
prior to 0.12.3 and 0.13.0, code for client certificate verification
imported the certificate chain sent by the client into a fixed size
`gnutls\_x509\_crt\_t x509[]` array without checking the number of
certificates is less than or equal to the array size. `gnutls\_x509\_crt\_t`
is a `typedef` for a pointer to an opaque GnuTLS structure created using
with `gnutls\_x509\_crt\_init()` before importing certificate data into it, so
no attacker-controlled data was written into the stack buffer, but writing
a pointer after the last array element generally triggered a segfault, and
could theoretically cause stack corruption otherwise (not observed in
practice). Server configurations that do not use client certificates
(`GnuTLSClientVerify ignore`, the default) are not affected. The problem
has been fixed in version 0.12.3 by checking the length of the provided
certificate chain and rejecting it if it exceeds the buffer length, and in
version 0.13.0 by rewriting certificate verification to use
`gnutls\_certificate\_verify\_peers()`, removing the need for the buffer
entirely. There is no workaround. Version 0.12.3 provides the minimal fix
for users of 0.12.x who do not wish to upgrade to 0.13.0 yet.

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| mod-gnutls | 26.04 LTS resolute | Not in release |
| 25.10 questing | Not in release |
| 24.04 LTS noble | Not in release |
| 22.04 LTS jammy | Needs evaluation |
| 20.04 LTS focal | Needs evaluation |
| 18.04 LTS bionic | Needs evaluation |
| 16.04 LTS xenial | Needs evaluation |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)

## Severity score breakdown

CVSS version:
CVSS v3.0

**Base score**

7.5 · High

* Base metrics

  | Parameter | Value |
  | --- | --- |
  | Attack vector | Network |
  | Attack complexity | Low |
  | Privileges required | None |
  | User interaction | None |
  | Scope | Unchanged |
  | Confidentiality impact | None |
  | Integrity impact | None |
  | Availability impact | High |
* Scores

  | Parameter | Value |
  | --- | --- |
  | Base score | 7.5 · High |
  | Exploitability score | - |
  | Impact score | - |

**Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33307)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-33307)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2026-33307)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2026-33307)

### Other references

* <https://www.cve.org/CVERecord?id=CVE-2026-33307>
* <https://github.com/airtower-luna/mod_gnutls/security/advisories/GHSA-gjpm-55p4-c76r>
* <https://github.com/airtower-luna/mod_gnutls/commit/bf4f08c49acae528e97885082cdee460f4534dc1>