CVE-2026-42010

HIGH

Gnutls: gnutls: authentication bypass via nul character in username

Title source: cna

Description

A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.

References (22)

Core 22

Core References

Vendor Advisory

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42010.json

Vendor Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2026:20613

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:20612

https://access.redhat.com/errata/RHSA-2026:20612

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:26319

https://access.redhat.com/errata/RHSA-2026:26319

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:26409

https://access.redhat.com/errata/RHSA-2026:26409

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:29197

https://access.redhat.com/errata/RHSA-2026:29197

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:30004

https://access.redhat.com/errata/RHSA-2026:30004

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:30849

https://access.redhat.com/errata/RHSA-2026:30849

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:30850

https://access.redhat.com/errata/RHSA-2026:30850

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:32962

https://access.redhat.com/errata/RHSA-2026:32962

https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-4

Issue Tracking, X_Refsource_Redhat issue-tracking x_refsource_redhat

RHBZ#2467289

https://bugzilla.redhat.com/show_bug.cgi?id=2467289

Vdb Entry, X_Refsource_Redhat vdb-entry x_refsource_redhat

https://access.redhat.com/security/cve/CVE-2026-42010

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:13274

https://access.redhat.com/errata/RHSA-2026:13274

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:20611

https://access.redhat.com/errata/RHSA-2026:20611

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:33125

https://access.redhat.com/errata/RHSA-2026:33125

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:34764

https://access.redhat.com/errata/RHSA-2026:34764

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:34788

https://access.redhat.com/errata/RHSA-2026:34788

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:34790

https://access.redhat.com/errata/RHSA-2026:34790

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:36004

https://access.redhat.com/errata/RHSA-2026:36004

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:36005

https://access.redhat.com/errata/RHSA-2026:36005

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:36006

https://access.redhat.com/errata/RHSA-2026:36006

Scores

CVSS v3 7.1

EPSS 0.0105

EPSS Percentile 60.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-170 CWE-626

Status published

Products (46)

gnu/gnutls

Red Hat/Red Hat AI Inference Server 3.2 1782951012

Red Hat/Red Hat AI Inference Server 3.2 1782951051

Red Hat/Red Hat AI Inference Server 3.2 1782951244

Red Hat/Red Hat Discovery 2 1782159791

Red Hat/Red Hat Discovery 2 1782166952

Red Hat/Red Hat Enterprise Linux 10

Red Hat/Red Hat Enterprise Linux 10 0:3.8.10-4.el10_2

Red Hat/Red Hat Enterprise Linux 10.0 Extended Update Support 0:3.8.9-9.el10_0.19

Red Hat/Red Hat Enterprise Linux 6

... and 36 more

Published May 07, 2026

Tracked Since May 07, 2026