Home

Description

A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform Resource Identifier (URI) or Service (SRV) Subject Alternative Names (SANs). This could cause the certificate validation process to incorrectly fall back to checking DNS hostnames against the Common Name (CN), potentially allowing the attacker to spoof legitimate services or intercept sensitive information.

PUBLISHED Reserved 2026-04-23 | Published 2026-05-26 | Updated 2026-06-02 | Assigner redhat




HIGH: 7.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

Problem types

Improper Certificate Validation

Product status

Default status
affected

0:3.8.10-4.el10_2 (rpm) before *
unaffected

Default status
affected

0:3.6.16-8.el8_10.6 (rpm) before *
unaffected

Default status
affected

0:3.6.16-8.el8_10.6 (rpm) before *
unaffected

Default status
affected

0:3.8.10-4.el9_8 (rpm) before *
unaffected

Default status
affected

0:3.8.10-4.el9_8 (rpm) before *
unaffected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Timeline

2026-05-06:Reported to Red Hat.
2026-04-29:Made public.

Credits

Red Hat would like to thank Oleh Konko (1Seal) for reporting this issue.

References

access.redhat.com/errata/RHSA-2026:20611 (RHSA-2026:20611) vendor-advisory

access.redhat.com/errata/RHSA-2026:20612 (RHSA-2026:20612) vendor-advisory

access.redhat.com/errata/RHSA-2026:20613 (RHSA-2026:20613) vendor-advisory

access.redhat.com/security/cve/CVE-2026-42012 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2467441 (RHBZ#2467441) issue-tracking

cve.org (CVE-2026-42012)

nvd.nist.gov (CVE-2026-42012)

Download JSON