CVE-2026-42010highCWE-170 CWE-626

CVE-2026-42010: falha de alta gravidade em gnutls

Gnutls: gnutls: authentication bypass via nul character in username

Publicada em 07 mai 2026 · Atualizada em 04 nov 2026

Seguir esta CVE + Monitorar Red Hat Enterprise Linux + Monitorar Red Hat OpenShift Container Platform

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 1.1%

A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Produtos afetados

CVEs relacionadas — gnutls

No mesmo produto, das mais perigosas para as menos.

CVE-2026-33845HIGHGnutls: gnutls: denial of service via dtls zero-length fragmentEPSS 2.1%CVE-2024-0553HIGHGnutls: incomplete fix for cve-2023-5981EPSS 1.6%CVE-2024-0567HIGHGnutls: rejects certificate chain with distributed trustEPSS 1.4%CVE-2026-1584HIGHGnutls: gnutls: remote denial of service via crafted clienthello with invalid psk binderEPSS 1.4%CVE-2026-42009HIGHGnutls: gnutls: denial of service via dtls packet reordering vulnerabilityEPSS 1.3%CVE-2026-2100MEDIUMP11-kit: null dereference via c_derivekey with specific null parametersEPSS 1.3%

Referências