Skip to main content

GnuTLS CVE-2026-42010

| EUVDEUVD-2026-28354 CRITICAL
Null Byte Interaction Error (Poison Null Byte) (CWE-626)
2026-05-07 secalert@redhat.com GHSA-m3r7-xjq8-gc4r
Authentication Bypass Red Hat Enterprise Linux Gnutls Openshift Container Platform Hardened Images Gnu
9.8
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify TLS server using RSA-PSK
  2. Delivery
    Initiate TLS handshake
  3. Exploit
    Send PSK identity with embedded NUL byte
  4. Execution
    Server truncates and matches legitimate username
  5. Impact
    Authentication bypassed, unauthorized access granted

Vulnerability Assessment

Weakness
CWE
CWE-626
Exploitation Conditions

Exploitation requires the target server to be explicitly configured to use the RSA-PSK (Pre-Shared Key) key-exchange ciphersuite in GnuTLS - that is the exact, non-default feature that must be enabled. Given RSA-PSK is in use, the attack itself needs no authentication, no user interaction, and only network reachability per the CVSS vector (AV:N/PR:N/UI:N): the attacker sends a PSK identity containing an embedded NUL character that the server wrongly matches against a truncated legitimate username. The decisive limiting factor is the RSA-PSK requirement; servers using standard certificate-based or non-PSK ciphersuites are not exploitable, which sharply narrows the real-world attack surface despite the 9.8 score.
Impact

Signals conflict and must be weighed together. The NVD CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), marking it critical and remotely exploitable without authentication on paper. However EPSS is only 0.15% (35th percentile), CISA SSVC rates Exploitation 'none' and Automatable 'no' with only 'partial' technical impact, there is no KEV listing, and no public exploit was identified. The decisive mitigating fact is that exploitation is gated on the server being explicitly configured for RSA-PSK - a niche, non-default ciphersuite rarely deployed in modern TLS stacks. For the vast majority of GnuTLS deployments this is therefore a high-CVSS-but-low-real-world-likelihood issue, while remaining a genuine critical-priority patch for the small population of services that actually rely on RSA-PSK. Note one discrepancy: CVSS asserts A:H, yet the described impact is an authentication bypass (unauthorized access) rather than a clear availability loss - verify the availability rating against the vendor advisory.
Exploit ScenarioDerived

An attacker targets a TLS service configured to accept RSA-PSK authentication - for example an internal appliance or service using PSK-based identities. The attacker initiates a TLS handshake and supplies a crafted PSK identity containing an embedded NUL byte (a valid prefix followed by '\0' and arbitrary trailing bytes) so the server truncates the comparison and matches a privileged stored identity, granting access without knowing the full credential. No public proof-of-concept currently exists, and the network vector means a single crafted handshake suffices once RSA-PSK is in use.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jun 24, 2026

Authentication bypass in GnuTLS affects servers that enable the RSA-PSK key exchange, where the PSK identity comparison treats a username containing an embedded NUL byte as equal to a legitimate truncated username. Remote attackers can send a crafted username to circumvent pre-shared-key authentication and gain unauthorized access. There is no public exploit identified at time of analysis, the EPSS probability is low (0.15%), and CISA SSVC scores exploitation as none - indicating high theoretical severity but no observed real-world abuse.

Earlier versions of this analysis (2)
v2 Jun 24, 2026 - 17:28 cvss changed CVSS 9.8

Authentication bypass in GnuTLS affects TLS servers configured to use the RSA-PSK key exchange, where username comparison mishandles embedded NUL characters and wrongly matches a NUL-containing username against a truncated stored username. Remote, unauthenticated attackers can send a specially crafted username to be treated as a different, valid identity and gain unauthorized access. The flaw is fixed (Red Hat RHSA errata and Ubuntu USN available); no public exploit identified at time of analysis and EPSS is low (0.15%, 35th percentile), and CISA SSVC scores exploitation as none.

v1 May 07, 2026 - 12:45 CVSS 7.1

Authentication bypass in GnuTLS RSA-PSK implementations allows remote authenticated attackers to impersonate other users by submitting usernames containing embedded NUL characters, which are incorrectly truncated during comparison. The vulnerability enables lateral privilege escalation from one authenticated account to another, including potential administrator access, on servers using the uncommon RSA-PSK key exchange mode. CVSS 7.1 (High) reflects network accessibility with low complexity, though the attack requires initial low-privilege authentication (PR:L). EPSS data not available; no CISA KEV listing or public exploit code identified at time of analysis, suggesting exploitation is not yet widespread.

RemediationAI

Patch available per vendor advisory: apply the fixed GnuTLS packages from your distribution. Red Hat customers should install the relevant errata - RHSA-2026:13274 (https://access.redhat.com/errata/RHSA-2026:13274) and the follow-on advisories RHSA-2026:20611, RHSA-2026:20612, RHSA-2026:20613, RHSA-2026:26319, RHSA-2026:26409, and RHSA-2026:29197 - matched to your RHEL/OpenShift version. Ubuntu users should apply USN-8284-1 (https://ubuntu.com/security/notices/USN-8284-1). Exact upstream fixed GnuTLS version numbers were not provided in the input and should be confirmed from the linked advisories rather than assumed. As an immediate compensating control where patching must wait, disable the RSA-PSK ciphersuite in the affected server's GnuTLS priority string (remove RSA-PSK key exchange from the configured priorities); the trade-off is that any legitimate clients depending on RSA-PSK authentication will lose connectivity, so confirm no production clients rely on it before disabling. Services that do not use RSA-PSK are not exposed and need only routine patching.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

GnuTLS is the GNU implementation of the TLS/SSL and DTLS protocols, bundled across Red Hat Enterprise Linux 6 through 10, OpenShift Container Platform 4, Red Hat hardened images, and Ubuntu. The flaw lives in the RSA-PSK (Pre-Shared Key with RSA) ciphersuite path, a TLS key-exchange mode that authenticates a peer by a shared secret tied to a username/identity hint. The root cause maps to CWE-626 (Null Byte Interaction Error): the identity string is compared in a way that mishandles an embedded NUL, so a value such as 'admin\0extra' is wrongly matched against the stored 'admin' identity, effectively truncating the comparison and defeating the intended PSK identity check.

Know when Gnutls gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.4 HIGH

Network, no auth or interaction, but AC:H because exploitation requires the non-default RSA-PSK configuration plus a crafted NUL-byte identity; impact is unauthorized access (C:H/I:H) with no clear availability loss (A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE 7.1 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Red Hat 7.1 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Updated
Jun 24, 2026 - 17:28 vuln.today
v3 - CVSS changed
Analysis Updated
Jun 24, 2026 - 17:28 vuln.today
v2 - CVSS changed
Severity Changed
Jun 24, 2026 - 17:22 NVD
HIGH CRITICAL
CVSS changed
Jun 24, 2026 - 17:22 NVD
7.1 (HIGH) 9.8 (CRITICAL)
CVE Published
May 07, 2026 - 12:16 nvd
HIGH 7.1

DescriptionNVD

A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest-Shamir-Adleman - Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.

Executive ViewAI

Why It Matters

GnuTLS versions affected by CVE-2026-42010 contain a critical authentication bypass in RSA-PSK key exchange allowing remote attackers to circumvent pre-shared-key authentication. No public exploit has been identified at time of analysis. Immediate patching is required to eliminate a fundamental vulnerability despite current low exploitation probability (EPSS 0.15%).

Business Impact: Severe
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.1%
Top 65% exploitable
Prevalence
High
core TLS library across RHEL, OpenShift, Ubuntu; RSA-PSK feature rarely enabled
Social Media
1
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
Very High
Technical Impact
Partial

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Affected Products (CPE)NVD

cpe:2.3:a:gnu:gnutls:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*

More in Gnutls

View all
CVE-2021-20231 CRITICAL POC
9.8 Mar 12

A flaw was found in gnutls. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentic
CVE-2014-3466 MEDIUM POC
6.8 Jun 03

Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.15
CVE-2020-24659 HIGH POC
7.5 Sep 04

An issue was discovered in GnuTLS before 3.6.15. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
CVE-2024-0553 HIGH POC
7.5 Jan 16

A vulnerability was found in GnuTLS. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no auth
CVE-2024-0567 HIGH POC
7.5

Alpine Linux: gnutls fixed in 3.8.3-r0
CVE-2012-1663 HIGH POC
7.5 Mar 13

Double free vulnerability in libgnutls in GnuTLS before 3.0.14 allows remote attackers to cause a denial of service (app
CVE-2023-0361 HIGH POC
7.4 Feb 15

A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. Rated high severity (C
CVE-2019-3836 HIGH POC
7.5 Apr 01

It was discovered in gnutls before version 3.6.7 upstream that there is an uninitialized pointer access in gnutls versio
CVE-2019-3829 HIGH POC
7.5 Mar 27

A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7. Rated high severity (CVSS 7.5), this vulnerability
CVE-2012-1569 MEDIUM POC
5.0 Mar 26

The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before 3.0.16 and other pr
CVE-2017-5334 CRITICAL
9.8 Mar 24

Double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 al
CVE-2012-1573 MEDIUM POC
5.0 Mar 26

gnutls_cipher.c in libgnutls in GnuTLS before 2.12.17 and 3.x before 3.0.15 does not properly handle data encrypted with

Same weakness CWE-626 – Null Byte Interaction Error (Poison Null Byte)

View all
CVE-2019-11936 CRITICAL
9.8
CVE-2026-62380 MEDIUM
6.3
CVE-2020-10773 MEDIUM
4.4

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: High
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed
SUSE Linux Enterprise Micro 5.4 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-42010 ADVISORY https://ubuntu.com/security/notices/USN-8284-1 ADVISORY https://vuldb.com/vuln/361842 REF https://access.redhat.com/errata/RHSA-2026:13274 REF https://access.redhat.com/errata/RHSA-2026:20611 REF https://access.redhat.com/errata/RHSA-2026:20612 REF https://access.redhat.com/errata/RHSA-2026:20613 REF https://access.redhat.com/errata/RHSA-2026:26319 REF https://access.redhat.com/errata/RHSA-2026:26409 REF https://access.redhat.com/errata/RHSA-2026:29197 REF https://access.redhat.com/errata/RHSA-2026:30004 REF https://access.redhat.com/errata/RHSA-2026:30849 REF https://access.redhat.com/errata/RHSA-2026:30850 REF https://access.redhat.com/errata/RHSA-2026:32962 REF https://access.redhat.com/errata/RHSA-2026:33125 REF https://access.redhat.com/errata/RHSA-2026:34764 REF https://access.redhat.com/errata/RHSA-2026:34788 REF https://access.redhat.com/errata/RHSA-2026:34790 REF https://access.redhat.com/errata/RHSA-2026:36004 REF https://access.redhat.com/errata/RHSA-2026:36005 REF https://access.redhat.com/errata/RHSA-2026:36006 REF https://access.redhat.com/errata/RHSA-2026:40762 REF https://access.redhat.com/errata/RHSA-2026:41921 REF https://access.redhat.com/errata/RHSA-2026:56853 REF https://access.redhat.com/errata/RHSA-2026:57483 REF https://access.redhat.com/errata/RHSA-2026:58981 REF https://access.redhat.com/errata/RHSA-2026:59831 REF https://access.redhat.com/errata/RHSA-2026:60019 REF https://access.redhat.com/errata/RHSA-2026:62409 REF https://access.redhat.com/errata/RHSA-2026:65839 REF https://access.redhat.com/errata/RHSA-2026:67857 REF https://access.redhat.com/errata/RHSA-2026:72502 REF https://access.redhat.com/errata/RHSA-2026:74674 REF https://access.redhat.com/errata/RHSA-2026:82304 REF https://access.redhat.com/errata/RHSA-2026:82322 REF https://access.redhat.com/errata/RHSA-2026:82347 REF https://access.redhat.com/errata/RHSA-2026:82354 REF https://access.redhat.com/errata/RHSA-2026:82372 REF https://access.redhat.com/errata/RHSA-2026:82857 REF https://access.redhat.com/errata/RHSA-2026:82888 REF https://access.redhat.com/security/cve/CVE-2026-42010 REF https://bugzilla.redhat.com/show_bug.cgi?id=2467289 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42010.json REF https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-4

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy