Skip to main content

GnuTLS CVE-2026-42010

| EUVDEUVD-2026-28354 CRITICAL
Null Byte Interaction Error (Poison Null Byte) (CWE-626)
2026-05-07 secalert@redhat.com GHSA-m3r7-xjq8-gc4r
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.4 HIGH

Network, no auth or interaction, but AC:H because exploitation requires the non-default RSA-PSK configuration plus a crafted NUL-byte identity; impact is unauthorized access (C:H/I:H) with no clear availability loss (A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
7.1 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Red Hat
7.1 HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

7
Analysis Updated
Jun 24, 2026 - 17:28 vuln.today
v3 (cvss_changed)
Analysis Updated
Jun 24, 2026 - 17:28 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jun 24, 2026 - 17:22 vuln.today
cvss_changed
Severity Changed
Jun 24, 2026 - 17:22 NVD
HIGH CRITICAL
CVSS changed
Jun 24, 2026 - 17:22 NVD
7.1 (HIGH) 9.8 (CRITICAL)
Analysis Generated
May 07, 2026 - 12:45 vuln.today
CVE Published
May 07, 2026 - 12:16 nvd
HIGH 7.1

DescriptionNVD

A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest-Shamir-Adleman - Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.

AnalysisAI

Authentication bypass in GnuTLS affects servers that enable the RSA-PSK key exchange, where the PSK identity comparison treats a username containing an embedded NUL byte as equal to a legitimate truncated username. Remote attackers can send a crafted username to circumvent pre-shared-key authentication and gain unauthorized access. There is no public exploit identified at time of analysis, the EPSS probability is low (0.15%), and CISA SSVC scores exploitation as none - indicating high theoretical severity but no observed real-world abuse.

Technical ContextAI

GnuTLS is the GNU implementation of the TLS/SSL and DTLS protocols, bundled across Red Hat Enterprise Linux 6 through 10, OpenShift Container Platform 4, Red Hat hardened images, and Ubuntu. The flaw lives in the RSA-PSK (Pre-Shared Key with RSA) ciphersuite path, a TLS key-exchange mode that authenticates a peer by a shared secret tied to a username/identity hint. The root cause maps to CWE-626 (Null Byte Interaction Error): the identity string is compared in a way that mishandles an embedded NUL, so a value such as 'admin\0extra' is wrongly matched against the stored 'admin' identity, effectively truncating the comparison and defeating the intended PSK identity check.

RemediationAI

Patch available per vendor advisory: apply the fixed GnuTLS packages from your distribution. Red Hat customers should install the relevant errata - RHSA-2026:13274 (https://access.redhat.com/errata/RHSA-2026:13274) and the follow-on advisories RHSA-2026:20611, RHSA-2026:20612, RHSA-2026:20613, RHSA-2026:26319, RHSA-2026:26409, and RHSA-2026:29197 - matched to your RHEL/OpenShift version. Ubuntu users should apply USN-8284-1 (https://ubuntu.com/security/notices/USN-8284-1). Exact upstream fixed GnuTLS version numbers were not provided in the input and should be confirmed from the linked advisories rather than assumed. As an immediate compensating control where patching must wait, disable the RSA-PSK ciphersuite in the affected server's GnuTLS priority string (remove RSA-PSK key exchange from the configured priorities); the trade-off is that any legitimate clients depending on RSA-PSK authentication will lose connectivity, so confirm no production clients rely on it before disabling. Services that do not use RSA-PSK are not exposed and need only routine patching.

CVE-2019-11043 CRITICAL POC
9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

CVE-2021-40438 CRITICAL POC
9.0 Sep 16

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.4

CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of

CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour

CVE-2016-5195 HIGH POC
7.0 Nov 10

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

CVE-2023-4911 HIGH POC
7.8 Oct 03

Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected

CVE-2017-1000253 HIGH POC
7.8 Oct 05

Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb7

CVE-2017-5645 CRITICAL POC
9.8 Apr 17

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events

CVE-2015-0240 CRITICAL POC
10.0 Feb 24

The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1

CVE-2016-6662 CRITICAL POC
9.8 Sep 20

Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2

CVE-2025-32463 CRITICAL POC
9.3 Jun 30

Sudo before 1.9.17p1 contains a local root escalation vulnerability (CVE-2025-32463, CVSS 9.3) through the --chroot opti

Vendor StatusVendor

SUSE

Severity: High
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed
SUSE Linux Enterprise Micro 5.4 Fixed

Share

CVE-2026-42010 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy