CVE-2026-42013highCWE-295

CVE-2026-42013: high-severity vulnerability in gnutls

Gnutls: gnutls: certificate validation bypass due to oversized subject alternative name

Published · Updated

Follow this CVE+ Monitor Red Hat Enterprise Linux+ Monitor Red Hat OpenShift Container Platform

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.2epss 0.4%
A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Affected products
gnutlsRed Hat · Cert Manager support for Red Hat OpenShift release 1.17Red Hat · Cert Manager support for Red Hat OpenShift release 1.18Red Hat · Cert Manager support for Red Hat OpenShift release 1.20Red Hat · Red Hat Discovery 2Red Hat · Red Hat Enterprise Linux 10Red Hat · Red Hat Enterprise Linux 10.0 Extended Update SupportRed Hat · Red Hat Enterprise Linux 6Red Hat · Red Hat Enterprise Linux 7 Extended Lifecycle SupportRed Hat · Red Hat Enterprise Linux 8Red Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportRed Hat · Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-OnRed Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportRed Hat · Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-OnRed Hat · Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceRed Hat · Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsRed Hat · Red Hat Enterprise Linux 9Red Hat · Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsRed Hat · Red Hat Enterprise Linux 9.4 Update Services for SAP SolutionsRed Hat · Red Hat Enterprise Linux 9.6 Extended Update SupportRed Hat · Red Hat Hardened ImagesRed Hat · Red Hat OpenShift AI 3.4Red Hat · Red Hat OpenShift Container Platform 4Red Hat · Red Hat OpenShift Container Platform 4.12Red Hat · Red Hat OpenShift Container Platform 4.16Red Hat · Red Hat OpenShift Container Platform 4.17Red Hat · Red Hat OpenShift Container Platform 4.18Red Hat · Red Hat OpenShift Container Platform 4.19Red Hat · Red Hat OpenShift Container Platform 4.20Red Hat · Red Hat OpenShift Container Platform 4.21Red Hat · Red Hat OpenShift Container Platform 4.22Red Hat · Red Hat OpenShift Container Platform 5Red Hat · Red Hat Update Infrastructure 5
Related CVEs — gnutls

In the same product, most dangerous first.

CVE-2026-33845HIGHGnutls: gnutls: denial of service via dtls zero-length fragmentEPSS 2.1%CVE-2024-0553HIGHGnutls: incomplete fix for cve-2023-5981EPSS 1.6%CVE-2024-0567HIGHGnutls: rejects certificate chain with distributed trustEPSS 1.4%CVE-2026-42009HIGHGnutls: gnutls: denial of service via dtls packet reordering vulnerabilityEPSS 1.3%CVE-2026-1584HIGHGnutls: gnutls: remote denial of service via crafted clienthello with invalid psk binderEPSS 1.3%CVE-2026-2100MEDIUMP11-kit: null dereference via c_derivekey with specific null parametersEPSS 1.3%