CVE-2026-1584

Publication date 10 February 2026

Last updated 10 February 2026


Ubuntu priority

Description

A TLS 1.3 resumption attempt with an invalid PSK binder value in ClientHello could lead to a denial of service attack via crashing the server.

Read the notes from the security team

Why is this CVE high priority?

A remote attacker can reliably cause a denial of service by sending malformed requests.

Learn more about Ubuntu priority

Status

Package Ubuntu Release Status
gnutls28 25.10 questing
Not affected
24.04 LTS noble  
Not affected
22.04 LTS jammy  
Not affected
20.04 LTS focal
Not affected
18.04 LTS bionic
Not affected
16.04 LTS xenial
Not affected

Notes


mdeslaur

This issue was introduced in 3.8.11