CVE-2015-2091: Apache Mod-Gnutls

Medium severity, CVSS 5.0. EPSS: 3.3% chance of exploitation in the next 30 days.

The authentication hook (mgs_hook_authz) in mod-gnutls 0.5.10 and earlier does not validate client certificates when "GnuTLSClientVerify require" is set, which allows remote attackers to spoof clients via a crafted certificate.

Affected products

• Apache Mod-Gnutls: up to and including 0.5.1

Published 2015-03-13. Last modified 2026-06-17.