Skip to main content

GnuTLS EUVDEUVD-2026-28386

| CVE-2026-42011 HIGH
Improper Certificate Validation (CWE-295)
2026-05-07 redhat GHSA-568w-37qx-3qc6
Authentication Bypass Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Hardened Images Red Hat Openshift Container Platform 4
7.4
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
7.4 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
SUSE
HIGH
qualitative
Red Hat
7.4 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

2
Analysis Generated
May 07, 2026 - 15:00 vuln.today
CVE Published
May 07, 2026 - 13:51 nvd
HIGH 7.4

DescriptionCVE.org

A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint checks during certificate validation. This bypass could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle attacks against affected systems.

AnalysisAI

Certificate validation in GnuTLS can be bypassed when a certificate chain contains Certificate Authorities with only excluded name constraints followed by CAs with permitted name constraints. Remote attackers can exploit this flaw (CVSS 7.4, AV:N/AC:H) to present invalid certificates that pass validation, enabling man-in-the-middle attacks or service impersonation against TLS-protected communications. The vulnerability affects Red Hat Enterprise Linux versions 6-10, OpenShift Container Platform 4, and Red Hat Hardened Images. No public exploit or active exploitation confirmed at time of analysis, though the technical nature suggests targeted attacks against high-value certificate infrastructure are feasible.

Technical ContextAI

GnuTLS is a widely-deployed open-source TLS/SSL library implementing secure communications protocols. This vulnerability stems from CWE-295 (Improper Certificate Validation), specifically in the name constraints extension (RFC 5280 Section 4.2.1.10) processing logic. Name constraints allow Certificate Authorities to restrict the namespaces (DNS domains, IP ranges, email domains) for which subordinate CAs can issue certificates. The flaw occurs during certificate chain validation when earlier CAs in the chain specify only excluded name constraints (e.g., 'cannot issue for *.internal.example.com') but later CAs specify permitted constraints (e.g., 'can only issue for *.example.com'). The GnuTLS validator incorrectly ignores the permitted constraints from the later CA when building the intersection of allowed namespaces, treating the absence of permitted constraints in earlier CAs as an implicit 'permit all.' This allows attackers who compromise or control a subordinate CA to issue certificates for domains outside the intended permitted namespace. Affected CPE products include all Red Hat Enterprise Linux distributions (RHEL 6-10), containerized environments (OpenShift Container Platform 4, Hardened Images), indicating the vulnerability exists in the base GnuTLS library package distributed across these platforms.

RemediationAI

Apply vendor-released patches for GnuTLS through Red Hat's standard update channels (yum/dnf update gnutls). Consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-42011 and Red Hat Bugzilla 2467437 for release-specific fixed package versions. For RHEL 6-10 systems, run 'yum update gnutls' or 'dnf update gnutls' followed by service restarts for applications using the library (httpd, nginx, curl, wget, email servers, VPN services). OpenShift Container Platform 4 administrators should apply cluster updates per Red Hat's OpenShift security bulletins and rebuild container images based on updated Red Hat Universal Base Images. Until patches are applied, compensating controls include: restricting TLS connections to well-known Certificate Authorities by explicitly configuring trust anchors (removes attacker's ability to introduce rogue CAs); implementing certificate pinning for critical internal services (bypasses CA validation entirely but requires maintenance); deploying TLS inspection proxies with non-GnuTLS validation libraries as a second validation layer (adds operational complexity and potential performance impact). These mitigations do not eliminate risk but reduce attack surface by limiting the certificate chains that can reach the vulnerable code path. Organizations using complex PKI hierarchies with name constraints should prioritize patching as workarounds are operationally difficult.

More in Red Hat Enterprise Linux 10

View all
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
CVE-2026-28367 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
CVE-2026-11610 HIGH
8.8 Jul 07

Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
CVE-2026-14474 HIGH
8.8 Jul 07

Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user

CVE-2026-52720 HIGH
8.8 Jun 15

Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co
CVE-2026-59851 HIGH
8.8 Jul 21

Privilege escalation via authentication bypass in libssh affects servers that enable GSSAPIKeyExchange, where the gssapi

Same weakness CWE-295 – Improper Certificate Validation

View all
CVE-2015-3152 MEDIUM POC
5.9
CVE-2017-2800 CRITICAL POC
9.8
CVE-2014-1266 HIGH POC
7.4
CVE-2022-47758 CRITICAL POC
9.8
CVE-2025-68121 CRITICAL POC
10.0
CVE-2025-29331 CRITICAL POC
9.8
CVE-2025-32878 CRITICAL POC
9.8
CVE-2024-3738 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed
SUSE Linux Enterprise Micro 5.4 Fixed

Share

EUVD-2026-28386 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy