A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint checks during certificate validation. This bypass could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle attacks against affected systems.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00475.

Exploitation none

Automatable no

Technical Impact total

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
affected
Version Status Constraints
0 affected —
Red Hat Red Hat Enterprise Linux 10 affected
Version Status Constraints
0:3.8.10-4.el10_2 unaffected < *
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support affected
Version Status Constraints
0:3.8.9-9.el10_0.19 unaffected < *
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support affected
Version Status Constraints
0:3.3.29-9.el7_9.2 unaffected < *
Red Hat Red Hat Enterprise Linux 8 affected
Version Status Constraints
0:3.6.16-8.el8_10.6 unaffected < *
Red Hat Red Hat Enterprise Linux 8 affected
Version Status Constraints
0:3.6.16-8.el8_10.6 unaffected < *
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support affected
Version Status Constraints
0:3.6.14-10.el8_4.1 unaffected < *
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support affected
Version Status Constraints
0:4.13-3.el8_4.1 unaffected < *
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On affected
Version Status Constraints
0:3.6.14-10.el8_4.1 unaffected < *
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On affected
Version Status Constraints
0:4.13-3.el8_4.1 unaffected < *
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support affected
Version Status Constraints
0:3.6.16-5.el8_6.5 unaffected < *
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support affected
Version Status Constraints
0:4.13-3.el8_6.2 unaffected < *
Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On affected
Version Status Constraints
0:3.6.16-5.el8_6.5 unaffected < *
Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On affected
Version Status Constraints
0:4.13-3.el8_6.2 unaffected < *
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service affected
Version Status Constraints
0:3.6.16-7.el8_8.4 unaffected < *
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service affected
Version Status Constraints
0:4.13-4.el8_8.1 unaffected < *
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions affected
Version Status Constraints
0:3.6.16-7.el8_8.4 unaffected < *
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions affected
Version Status Constraints
0:4.13-4.el8_8.1 unaffected < *
Red Hat Red Hat Enterprise Linux 9 affected
Version Status Constraints
0:3.8.10-4.el9_8 unaffected < *
Red Hat Red Hat Enterprise Linux 9 affected
Version Status Constraints
0:3.8.10-4.el9_8 unaffected < *
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions affected
Version Status Constraints
0:3.7.6-21.el9_2.7 unaffected < *
Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions affected
Version Status Constraints
0:3.8.3-4.el9_4.6 unaffected < *
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support affected
Version Status Constraints
0:3.8.3-6.el9_6.4 unaffected < *
Red Hat Red Hat OpenShift Container Platform 4.12 affected
Version Status Constraints
412.86.202608241157-0 unaffected < *
Red Hat Red Hat OpenShift Container Platform 4.16 affected
Version Status Constraints
416.94.202608150307-0 unaffected < *
Red Hat Red Hat OpenShift Container Platform 4.17 affected
Version Status Constraints
417.94.202608250221-0 unaffected < *
Red Hat Red Hat OpenShift Container Platform 4.18 affected
Version Status Constraints
418.94.202608142238-0 unaffected < *
Red Hat Red Hat OpenShift Container Platform 4.19 affected
Version Status Constraints
4.19.9.6.202607151909-0 unaffected < *
Red Hat Cert Manager support for Red Hat OpenShift release 1.17 affected
Version Status Constraints
1791371080 unaffected < *
Red Hat Cert Manager support for Red Hat OpenShift release 1.17 affected
Version Status Constraints
1791371069 unaffected < *
Red Hat Cert Manager support for Red Hat OpenShift release 1.17 affected
Version Status Constraints
1791788287 unaffected < *
Red Hat Cert Manager support for Red Hat OpenShift release 1.18 affected
Version Status Constraints
1791459707 unaffected < *
Red Hat Cert Manager support for Red Hat OpenShift release 1.18 affected
Version Status Constraints
1791459711 unaffected < *
Red Hat Cert Manager support for Red Hat OpenShift release 1.18 affected
Version Status Constraints
1791459759 unaffected < *
Red Hat Cert Manager support for Red Hat OpenShift release 1.18 affected
Version Status Constraints
1789029076 unaffected < *
Red Hat Cert Manager support for Red Hat OpenShift release 1.20 affected
Version Status Constraints
1790598593 unaffected < *
Red Hat Red Hat Discovery 2 affected
Version Status Constraints
1782159791 unaffected < *
Red Hat Red Hat Discovery 2 affected
Version Status Constraints
1782166952 unaffected < *
Red Hat Red Hat Hardened Images affected
Version Status Constraints
3.8.13-1.hum1 unaffected < *
Red Hat Red Hat OpenShift AI 3.4 affected
Version Status Constraints
1790703542 unaffected < *
Red Hat Red Hat Update Infrastructure 5 affected
Version Status Constraints
1781525684 unaffected < *
Red Hat Red Hat Update Infrastructure 5 affected
Version Status Constraints
1781525671 unaffected < *
Red Hat Red Hat Update Infrastructure 5 affected
Version Status Constraints
1781525693 unaffected < *
Red Hat Red Hat Update Infrastructure 5 affected
Version Status Constraints
1781525739 unaffected < *
Red Hat Red Hat Update Infrastructure 5 affected
Version Status Constraints
1787241211 unaffected < *
Red Hat Red Hat Update Infrastructure 5 affected
Version Status Constraints
1787135742 unaffected < *
Red Hat Red Hat Update Infrastructure 5 affected
Version Status Constraints
1787241260 unaffected < *
Red Hat Red Hat Enterprise Linux 6 unaffected —
Red Hat Red Hat OpenShift Container Platform 4 unaffected —

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Redhat Subscribe
Enterprise Linux Subscribe
Hardened Images Subscribe
Openshift Container Platform Subscribe

Project Subscriptions

Vendors Products
Redhat Subscribe
Cert Manager Subscribe
Discovery Subscribe
Enterprise Linux Subscribe
Enterprise Linux Eus Subscribe
Hardened Images Subscribe
Hummingbird Subscribe
Openshift Subscribe
Openshift Ai Subscribe
Openshift Container Platform Subscribe
Rhel Aus Subscribe
Rhel E4s Subscribe
Rhel Els Subscribe
Rhel Eus Subscribe
Rhel Eus Long Life Subscribe
Rhel Tus Subscribe
Rhui Subscribe
Advisories
Source ID Title
Debian DLA Debian DLA DLA-4595-1 gnutls28 security update
Debian DSA Debian DSA DSA-6281-1 gnutls28 security update
Ubuntu USN Ubuntu USN USN-8284-1 GnuTLS vulnerabilities
Ubuntu USN Ubuntu USN USN-8539-1 GnuTLS vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://access.redhat.com/errata/RHSA-2026:13274 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:20611 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:20612 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:20613 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:26319 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:26409 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:29197 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:30004 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:30849 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:30850 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:32962 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:33125 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:40762 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:41921 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:43575 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:56853 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:57483 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:58981 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:59831 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:60019 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:72502 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:74674 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:82304 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:82322 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:82347 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:82354 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:82372 cve-icon cve-icon
https://access.redhat.com/security/cve/CVE-2026-42011 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2467437 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-42011 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-42011 cve-icon
https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-6 cve-icon cve-icon
History

Wed, 14 Oct 2026 03:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:cert_manager:1.17::el9
cpe:/a:redhat:cert_manager:1.18::el9
References

Fri, 02 Oct 2026 02:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat openshift Ai
CPEs cpe:/a:redhat:openshift_ai:3.4::el9
Vendors & Products Redhat openshift Ai
References

Tue, 29 Sep 2026 01:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat cert Manager
CPEs cpe:/a:redhat:cert_manager:1.20::el9
Vendors & Products Redhat cert Manager
References

Thu, 03 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.17::el9
References

Thu, 03 Sep 2026 12:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.12::el8
References

Mon, 31 Aug 2026 02:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.16::el9
References

Wed, 26 Aug 2026 16:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.18::el9
References

Tue, 25 Aug 2026 10:00:00 +0000

Type Values Removed Values Added
References

Wed, 22 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Els
CPEs cpe:/o:redhat:enterprise_linux:7 cpe:/a:redhat:openshift:4.19::el9
cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Els
References

Mon, 20 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_e4s:9.2::appstream
cpe:/o:redhat:rhel_e4s:9.2::baseos
References

Tue, 30 Jun 2026 03:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_aus:8.4::appstream
cpe:/a:redhat:rhel_eus_long_life:8.4::appstream
cpe:/o:redhat:rhel_aus:8.4::baseos
cpe:/o:redhat:rhel_eus_long_life:8.4::baseos
References

Mon, 29 Jun 2026 12:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_e4s:9.4::appstream
cpe:/o:redhat:rhel_e4s:9.4::baseos
References

Mon, 29 Jun 2026 08:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Eus Long Life
Redhat rhel Tus
CPEs cpe:/a:redhat:rhel_aus:8.6::appstream
cpe:/a:redhat:rhel_e4s:8.8::appstream
cpe:/a:redhat:rhel_eus_long_life:8.6::appstream
cpe:/a:redhat:rhel_tus:8.8::appstream
cpe:/o:redhat:rhel_aus:8.6::baseos
cpe:/o:redhat:rhel_e4s:8.8::baseos
cpe:/o:redhat:rhel_eus_long_life:8.6::baseos
cpe:/o:redhat:rhel_tus:8.8::baseos
Vendors & Products Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Eus Long Life
Redhat rhel Tus
References

Fri, 26 Jun 2026 07:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Eus
CPEs cpe:/a:redhat:rhel_eus:9.6::appstream
cpe:/o:redhat:rhel_eus:9.6::baseos
Vendors & Products Redhat rhel Eus
References

Thu, 25 Jun 2026 23:45:00 +0000

Type Values Removed Values Added
References

Wed, 24 Jun 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat discovery
CPEs cpe:/a:redhat:discovery:2::el9
Vendors & Products Redhat discovery
References

Tue, 16 Jun 2026 22:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat enterprise Linux Eus
Redhat rhui
CPEs cpe:/a:redhat:rhui:5::el9
cpe:/o:redhat:enterprise_linux_eus:10.0
Vendors & Products Redhat enterprise Linux Eus
Redhat rhui
References

Tue, 02 Jun 2026 15:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:9 cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/o:redhat:enterprise_linux:9::baseos
References

Mon, 01 Jun 2026 20:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:10.2
References

Wed, 27 May 2026 03:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:8 cpe:/a:redhat:enterprise_linux:8::appstream
cpe:/o:redhat:enterprise_linux:8::baseos
References

Thu, 14 May 2026 23:00:00 +0000

Type Values Removed Values Added
References

Fri, 08 May 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 07 May 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat hardened Images
Redhat openshift Container Platform
Vendors & Products Redhat hardened Images
Redhat openshift Container Platform

Thu, 07 May 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 07 May 2026 14:30:00 +0000

Type Values Removed Values Added
Description A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint checks during certificate validation. This bypass could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle attacks against affected systems.
Title Gnutls: gnutls: security bypass due to incorrect name constraint handling
First Time appeared Redhat
Redhat enterprise Linux
Redhat hummingbird
Redhat openshift
Weaknesses CWE-295
CPEs cpe:/a:redhat:hummingbird:1
cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat hummingbird
Redhat openshift
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-10-14T03:13:43.508Z

Reserved: 2026-04-23T11:23:46.517Z

Link: CVE-2026-42011

cve-icon Vulnrichment

Updated: 2026-05-07T14:55:14.420Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-05-07T15:16:09.760

Modified: 2026-10-14T04:18:21.187

Link: CVE-2026-42011

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-04-29T00:00:00Z

Links: CVE-2026-42011 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-05-07T21:24:41Z

Weaknesses