CVE-2026-42011
7.4 HIGHA flaw was found in gnutls
Published: 2026-05-07 · Last updated: 2026-06-02
Severity and scoring
- CVSS
- 7.4 HIGH
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- CWE
- CWE-295
Description
A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint checks during certificate validation. This bypass could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle attacks against affected systems.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-42011
- [Other]https://access.redhat.com/errata/RHSA-2026:13274
- [Other]https://access.redhat.com/errata/RHSA-2026:20611
- [Other]https://access.redhat.com/errata/RHSA-2026:20612
- [Other]https://access.redhat.com/errata/RHSA-2026:20613
- [Other]https://access.redhat.com/security/cve/CVE-2026-42011
- [Other]https://bugzilla.redhat.com/show_bug.cgi?id=2467437
Related CVEs
Same CWE
- CVE-2025-71261 — An attacker with network-level access between the SUSE Virtualization and Rancher Manager in SUSE Harvester before 1.8.0 could interfere... (8.6 HIGH)
- CVE-2026-9259 — Improper validation of server certificates in Canon EOS Network Setting Tool Version 1.5.0 or earlier (6.5 MEDIUM)
- CVE-2026-9258 — Improper validation of SSH host keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier (6.5 MEDIUM)
- CVE-2026-45388 — In OCaml-TLS before 2.1.0, the client implementation does insufficient checks of the certificate provided by the server, which allows imp... (9.1 CRITICAL)
- CVE-2026-45170 — Idira Privilege Cloud Connector versions prior 1.1.100504 under specific conditions and configuration scenarios, TLS certificate validati...