A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | affected | — |
| Red Hat | Red Hat Enterprise Linux 6 | unknown | — |
| Red Hat | Red Hat Enterprise Linux 7 | affected | — |
| Red Hat | Red Hat Enterprise Linux 8 | affected | — |
| Red Hat | Red Hat Enterprise Linux 9 | affected | — |
| Red Hat | Red Hat Hardened Images | affected | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | affected | — |
No data.
No data.
No data.
Project Subscriptions
Advisories
| Source | ID | Title |
|---|---|---|
 Debian DLA |
DLA-4595-1 | gnutls28 security update |
 Debian DSA |
DSA-6281-1 | gnutls28 security update |
 Ubuntu USN |
USN-8284-1 | GnuTLS vulnerabilities |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Tue, 26 May 2026 21:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks. | |
| Title | Gnutls: gnutls: certificate validation bypass due to oversized subject alternative name | |
| First Time appeared |
Redhat
Redhat enterprise Linux Redhat hummingbird Redhat openshift |
|
| Weaknesses | CWE-1284 | |
| CPEs | cpe:/a:redhat:hummingbird:1 cpe:/a:redhat:openshift:4 cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:6 cpe:/o:redhat:enterprise_linux:7 cpe:/o:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:9 |
|
| Vendors & Products |
Redhat
Redhat enterprise Linux Redhat hummingbird Redhat openshift |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2026-05-26T21:29:32.887Z
Reserved: 2026-04-23T11:23:46.517Z
Link: CVE-2026-42013
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses