Dear Maintainer,

MITRE published six CVEs against GnuTLS 3.8.13 on 2026-10-08, all with
public proofs of concept (https://github.com/lkloliver/poc). The security
tracker currently notes "check if <gist> reported upstream, valid?" on
each; this report is meant to answer both halves.

Reproduced on 2026-10-10 with the Debian packages, running only certtool /
gnutls-cli / gnutls-serv on the published PEM files (none of the PoC
scripts), in debian:sid-slim and debian:trixie-slim containers:

   sid     3.8.13-1          all six reproduce
   trixie  3.8.9-3+deb13u4   all six reproduce (the 3.8.13 patch set is in,
                             so CVE-2026-88647 — which bypasses the
                             CVE-2026-42012 fix — applies to trixie as well)

Results, same on both:

   CVE-2026-88647  SRV otherName with an OCTET STRING value does not
suppress
                   the CN fallback: gnutls-cli
--verify-hostname=target.example
                   → "The certificate is trusted", handshake completed.
                   Controls: well-formed IA5String SRV → rejected (the 42012
                   fix works); no-SAN CN mismatch → rejected.
   CVE-2026-95210  critical keyUsage with extnValue 05 00 (ASN.1 NULL):
                   certtool --verify → trusted; certtool -i on the same
file →
                   "get_key_usage: ASN1 parser: Error in TAG".
   CVE-2026-67693  critical keyUsage all-zero + EKU serverAuth → trusted by
                   certtool and by gnutls-cli (handshake completed).
   CVE-2026-95184  EE O=Evil under permitted {directoryName: O=Good} →
trusted
                   (OpenSSL 3.5/3.6: error 47 permitted subtree violation).
   CVE-2026-88648  defect 1 as 95184; defect 2: EE carrying an excluded SRV
                   otherName → trusted (OpenSSL: error 51); defect 3: EE
O=Good
                   under excluded {directoryName: O=Blocked} → rejected
                   (OpenSSL: OK).
   CVE-2026-95209  SAN-less leaf CN=random.host.org under permitted
                   {dNSName: example.com} → rejected. OpenSSL rejects too;
                   arguably intended behaviour, listed for completeness.

Upstream: no public GnuTLS issue existed for any of the six as of
2026-10-10. Reported to GnuTLS as confidential issue
https://gitlab.com/gnutls/gnutls/-/work_items/1965 the same day, with the
transcripts below. Red Hat bugzilla has auto-imported entries (e.g.
#2548057 for CVE-2026-88647, #2548190 for CVE-2026-67693), status NEW.

Reachability note for the "CA within the trust boundary" question:
88647, 95210 and 67693 need only a CA-signed end-entity certificate with a
malformed extension; 95184, 88648 and 95209 need a constrained
subordinate CA, i.e. exactly the case name constraints exist for.

Transcripts (certtool / gnutls-cli output for every case and control) are
attached; the runner script is a dozen certtool invocations and is attached
too.

Thank you for your work on Debian.