Vulnerability record · CVE-2009-5144 · published 3 February 2018

CVE-2009-5144: Mod gnutls project mod gnutls vulnerability

MMod Gnutls Project · Mod Gnutls

mod-gnutls does not validate client certificates when "GnuTLSClientVerify require" is set in a directory context, which allows remote attackers to spoof clients via a crafted certificate.

7.5 CVSS 3.0 High EPSS 0.84% · top 43.7% CWE-254 · CWE-254

7.5CVSS 3.0 base score, v2 5.0

0.84%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

8References

16 Jun 2026Last modified by NVD

Description

mod-gnutls does not validate client certificates when "GnuTLSClientVerify require" is set in a directory context, which allows remote attackers to spoof clients via a crafted certificate.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

MMod Gnutls Mod Gnutls Project

References

Link	Tags
http://issues.outoforder.cc/view.php?id=93	Broken Link
http://www.openwall.com/lists/oss-security/2015/02/26/6	Issue TrackingMailing List
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=578663	Issue TrackingMailing ListPatch
https://bugzilla.redhat.com/show_bug.cgi?id=1197127	Issue TrackingPatch
http://issues.outoforder.cc/view.php?id=93	Broken Link
http://www.openwall.com/lists/oss-security/2015/02/26/6	Issue TrackingMailing List
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=578663	Issue TrackingMailing ListPatch
https://bugzilla.redhat.com/show_bug.cgi?id=1197127	Issue TrackingPatch

Track CVE-2009-5144 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2026-33307Mod gnutls project mod gnutls stack-based buffer overflow vulnerabilityMod_gnutls is a TLS module for Apache HTTPD based on GnuTLS. In versions prior to 0.12.3 and 0.13.0, code for client certificate verification importe…EPSS 0.31%24 Mar 2026 7.5CVE-2023-25824Mod gnutls project mod gnutls vulnerabilityMod_gnutls is a TLS module for Apache HTTPD based on GnuTLS. Versions from 0.9.0 to 0.12.0 (including) did not properly fail blocking read operations…EPSS 1.1%23 Feb 2023 5.9CVE-2026-33308Mod gnutls project mod gnutls improper certificate validation vulnerabilityMod_gnutls is a TLS module for Apache HTTPD based on GnuTLS. Prior to version 0.13.0, code for client certificate verification did not check the key …EPSS 0.24%24 Mar 2026

Source: NIST National Vulnerability Database (record CVE-2009-5144), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.