CVE-2015-2091: The authentication hook (mgs_hook_authz) in mod-gnutls 0.5.10 and earlier does not validate client certific...

Security readout for executives and security teams

CVE-2015-2091 is an authentication bypass in mod_gnutls. Servers using affected versions could believe a client certificate is acceptable even when it has not been properly validated, allowing a remote attacker to impersonate an authorized client. Exposure is limited to systems running mod_gnutls 0.5.10 or earlier, especially Apache deployments relying on client certificate authentication with GnuTLSClientVerify require. Treat as high priority for any service that uses client certificates as a primary access control. For systems not running mod_gnutls or not using client certificate authentication, urgency is lower. Mitigation focus: Inventory Apache deployments using mod_gnutls.; Identify systems running mod_gnutls 0.5.10 or earlier.; Review Debian, Gentoo, or package vendor guidance for fixed packages..

Prepared

Jun 14, 2026, 05:11 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.