Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Send crafted PKCS#12 over network
  2. Delivery
    Service passes structure to GnuTLS parser
  3. Exploit
    Bag append triggers off-by-one write
  4. Execution
    Adjacent heap memory corrupted
  5. Impact
    Process crash causes denial of service

Vulnerability Assessment

Weakness
CWE
CWE-193
ASVS 5.0
V15 - Secure Coding and Architecture Off-by-one prevention
Exploitation Conditions

Exploitation specifically requires that the target application passes a PKCS#12 structure to GnuTLS for parsing where a bag within that structure already contains exactly 32 elements, triggering the append path with the defective bounds check. Services that accept externally-supplied PKCS#12 files are the primary exposure: TLS endpoints with client certificate (mutual TLS) authentication enabled, VPN gateways accepting PKCS#12 keystores, and administrative interfaces that import certificate bundles. The CVSS vector (PR:N, UI:N) confirms no authentication and no user interaction are required on the attacker's side. Exploitation is constrained to attack surfaces where the attacker controls or can influence the PKCS#12 structure reaching GnuTLS parsing logic - services using only PEM certificates are not exposed. The requirement for a specifically structured 32-element bag introduces a mild crafting prerequisite but does not constitute a meaningful barrier for a motivated attacker.
Impact

The CVSS 3.1 score of 5.3 Medium (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) reflects a remotely triggerable, zero-complexity, unauthenticated flaw with confirmed impact only on availability, rated Low. This signals a bounded DoS rather than a systemic compromise vector. The vulnerability is not listed in the CISA KEV catalog and no publicly available exploit code has been identified, placing exploitation status at no public exploit identified at time of analysis. EPSS data was not included in the provided intelligence, limiting probabilistic exploitation forecasting - this gap should be noted when triaging. The vendor description leaves open 'potentially other unspecified impacts,' which is a notable qualifier: off-by-one heap writes can under specific memory layout conditions escalate to code execution, but this is unconfirmed from available data and should not be treated as confirmed. The combination of Low availability impact, absence of KEV or POC, and scope-unchanged impact makes this a medium-priority patch target rather than an emergency response item. However, internet-facing deployments that accept externally supplied PKCS#12 structures (TLS endpoints with mutual authentication, VPN gateways, certificate import interfaces) carry materially higher risk and should prioritize patching.
Exploit ScenarioDerived

A remote unauthenticated attacker crafts a PKCS#12 file containing a bag pre-populated with exactly 32 elements, then submits it to a GnuTLS-backed service that parses client-supplied PKCS#12 input - such as a mutual-TLS endpoint, a VPN gateway, or a web application's certificate import interface. When GnuTLS attempts to append a further element, the off-by-one bounds check fails, writing one element past the end of the internal array and corrupting adjacent heap memory, crashing the service process. No public exploit code has been identified, but the low attack complexity (AC:L) and absence of any authentication requirement mean a working denial-of-service payload could be developed with moderate effort by a skilled attacker.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 26, 2026

Memory corruption via an off-by-one error in GnuTLS PKCS#12 bag element handling exposes any application using GnuTLS to remote unauthenticated denial of service - and potentially unspecified further impact - when a crafted PKCS#12 structure is parsed. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no elevated complexity, making internet-exposed services that parse client-supplied PKCS#12 inputs the primary risk surface. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis.

RemediationAI

Apply the Red Hat-issued erratum for GnuTLS via standard yum/dnf patching channels; consult https://access.redhat.com/security/cve/CVE-2026-42015 for the specific RHSA advisory number and exact fixed package version, as that data was not present in the provided intelligence. An exact fixed GnuTLS version cannot be cited here without independent confirmation from the advisory. As a compensating control where immediate patching is not feasible, disable or restrict processing of externally-supplied PKCS#12 inputs: for TLS endpoints, this means disabling mutual TLS (client certificate authentication) until patched - note this will break PKI-based client authentication workflows. For OpenShift Container Platform 4 nodes, prioritize patching of control-plane and ingress nodes that terminate TLS from untrusted networks. Services that consume only PEM-formatted certificates and never parse PKCS#12 files are not directly exposed by this flaw and carry lower urgency.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

GnuTLS is a widely deployed open-source TLS/SSL and DTLS implementation used as the core cryptographic library across Red Hat Enterprise Linux distributions and derivative platforms. PKCS#12 is a binary container format (RFC 7292) used to bundle cryptographic objects - certificates, private keys, and CA chains - into transportable 'bags.' The root cause is CWE-193 (Off-by-One Error): the internal bounds check governing the bag element array does not correctly enforce a limit at exactly 32 elements, permitting a write one index beyond the allocated array boundary when a 33rd element is appended. This out-of-bounds write corrupts adjacent heap memory, which can destabilize or crash the host process. The flaw is confirmed present across GnuTLS as packaged in Red Hat Enterprise Linux 6 through 10 (CPE: cpe:2.3:a:red_hat:red_hat_enterprise_linux_6 through _10), Red Hat Hardened Images (cpe:2.3:a:red_hat:red_hat_hardened_images), and Red Hat OpenShift Container Platform 4 (cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4). The upstream GnuTLS version range is not specified in the available CPE data.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
SUSE MEDIUM
Red Hat 5.3 MEDIUM

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

DescriptionCVE.org

A flaw was found in gnutls. An off-by-one error exists in the PKCS#12 bag element bounds check. This vulnerability allows an remote attacker to write past the internal array of a PKCS#12 bag when appending to a bag that already contains 32 elements. This memory corruption could lead to a denial of service (DoS) or potentially other unspecified impacts.

Threat Intelligence Overview

EPSS Score
0.1%
Top 66% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact· derived
Medium
Technical Impact
Partial

Priority Score

26
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +26
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_hardened_images:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-193 – Off-by-one Error

View all
CVE-2021-3156 HIGH POC
7.8
CVE-2022-34970 CRITICAL POC
9.8
CVE-2021-31875 CRITICAL POC
9.8
CVE-2020-8443 CRITICAL POC
9.8
CVE-2019-14532 CRITICAL POC
9.8
CVE-2019-19906 HIGH POC
7.5
CVE-2026-86297 HIGH POC
8.2
CVE-2019-13306 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-EC2 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-EC2 Image SLES-GCE Image SLES-GCE-3P Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-EC2 Image SLES-SAP-GCE Image SLES-SAP-GCE-3P Affected
SUSE Liberty Linux 8 Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://ubuntu.com/security/notices/USN-8539-1 ADVISORY https://vuldb.com/vuln/365837 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2087/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2115/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21752/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21784/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21815/ REF https://access.redhat.com/errata/RHSA-2026:13274 REF https://access.redhat.com/errata/RHSA-2026:20611 REF https://access.redhat.com/errata/RHSA-2026:20612 REF https://access.redhat.com/errata/RHSA-2026:20613 REF https://access.redhat.com/errata/RHSA-2026:26319 REF https://access.redhat.com/errata/RHSA-2026:26409 REF https://access.redhat.com/errata/RHSA-2026:29197 REF https://access.redhat.com/errata/RHSA-2026:30004 REF https://access.redhat.com/errata/RHSA-2026:30849 REF https://access.redhat.com/errata/RHSA-2026:30850 REF https://access.redhat.com/errata/RHSA-2026:32962 REF https://access.redhat.com/errata/RHSA-2026:33125 REF https://access.redhat.com/errata/RHSA-2026:41921 REF https://access.redhat.com/errata/RHSA-2026:43575 REF https://access.redhat.com/errata/RHSA-2026:58981 REF https://access.redhat.com/errata/RHSA-2026:72502 REF https://access.redhat.com/errata/RHSA-2026:74674 REF https://access.redhat.com/errata/RHSA-2026:82304 REF https://access.redhat.com/errata/RHSA-2026:82322 REF https://access.redhat.com/errata/RHSA-2026:82347 REF https://access.redhat.com/errata/RHSA-2026:82354 REF https://access.redhat.com/errata/RHSA-2026:82372 REF https://access.redhat.com/errata/RHSA-2026:82857 REF https://access.redhat.com/errata/RHSA-2026:82888 REF https://access.redhat.com/security/cve/CVE-2026-42015 REF https://bugzilla.redhat.com/show_bug.cgi?id=2467678 REF https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-11

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy