What’s Vulnerable › Vulnerabilities

CVE-2026-42010: Gnutls: gnutls: authentication bypass via nul character in username

Description

A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.

Affected products

How to fix

Upgrade to a fixed version: [UNKNOWN] gnutls 3.8.13; Red Hat Cert Manager support for Red Hat OpenShift release 1.17 1791371080; Red Hat Cert Manager support for Red Hat OpenShift release 1.18 1791459707; Red Hat Cert Manager support for Red Hat OpenShift release 1.20 1790598593; Red Hat OpenShift Container Platform 4.18 418.94.202608142238-0; Red Hat AI Inference Server 3.2 1782951051; Red Hat Discovery 2 1782159791; Red Hat Enterprise Linux 10 0:3.8.10-4.el10_2; Red Hat Enterprise Linux 10.0 Extended Update Support 0:3.8.9-9.el10_0.19; Red Hat Enterprise Linux 8 0:3.6.16-8.el8_10.6; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:3.6.14-10.el8_4.1; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 0:3.6.14-10.el8_4.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-42010 or the next vulnerability affects your stack