CVE-2026-42013

HIGH

Gnutls: gnutls: certificate validation bypass due to oversized subject alternative name

Title source: cna

Description

A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks.

References (18)

Core 18

Core References

https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-8

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:20611

https://access.redhat.com/errata/RHSA-2026:20611

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:20612

https://access.redhat.com/errata/RHSA-2026:20612

Vendor Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2026:20613

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:26319

https://access.redhat.com/errata/RHSA-2026:26319

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:13274

https://access.redhat.com/errata/RHSA-2026:13274

Vdb Entry, X_Refsource_Redhat vdb-entry x_refsource_redhat

https://access.redhat.com/security/cve/CVE-2026-42013

Issue Tracking, X_Refsource_Redhat issue-tracking x_refsource_redhat

RHBZ#2467448

https://bugzilla.redhat.com/show_bug.cgi?id=2467448

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:41921

https://access.redhat.com/errata/RHSA-2026:41921

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:26409

https://access.redhat.com/errata/RHSA-2026:26409

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:29197

https://access.redhat.com/errata/RHSA-2026:29197

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:30004

https://access.redhat.com/errata/RHSA-2026:30004

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:30849

https://access.redhat.com/errata/RHSA-2026:30849

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:30850

https://access.redhat.com/errata/RHSA-2026:30850

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:32962

https://access.redhat.com/errata/RHSA-2026:32962

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:33125

https://access.redhat.com/errata/RHSA-2026:33125

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:40762

https://access.redhat.com/errata/RHSA-2026:40762

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:43575

https://access.redhat.com/errata/RHSA-2026:43575

Scores

CVSS v3 8.2

EPSS 0.0042

EPSS Percentile 34.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-295

Status published

Products (35)

Red Hat/Red Hat Discovery 2 1782159791

Red Hat/Red Hat Discovery 2 1782166952

Red Hat/Red Hat Enterprise Linux 10

Red Hat/Red Hat Enterprise Linux 10 0:3.8.10-4.el10_2

Red Hat/Red Hat Enterprise Linux 10.0 Extended Update Support 0:3.8.9-9.el10_0.19

Red Hat/Red Hat Enterprise Linux 6

Red Hat/Red Hat Enterprise Linux 7

Red Hat/Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:3.3.29-9.el7_9.2

Red Hat/Red Hat Enterprise Linux 8

Red Hat/Red Hat Enterprise Linux 8 0:3.6.16-8.el8_10.6

... and 25 more

Published May 26, 2026

Tracked Since May 27, 2026