Skip to content

CVE-2026-42011 Gnutls: gnutls: security bypass due to incorrect name constraint handling

HighCVSS 7.4 EPSS 0.48%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint checks during certificate validation. This bypass could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle attacks against affected systems.

Affected products

ProductAffected versionsFixed in
redhat/gnutls(Red Hat:enterprise_linux:10.2) < 3.8.10-4.el10_2 3.8.10-4.el10_2
redhat/gnutls(Red Hat:enterprise_linux_eus:10.0) < 3.8.9-9.el10_0.19 3.8.9-9.el10_0.19
redhat/gnutls(Red Hat:rhel_els:7) < 3.3.29-9.el7_9.2 3.3.29-9.el7_9.2
redhat/gnutls(Red Hat:enterprise_linux:8) < 3.6.16-8.el8_10.6 3.6.16-8.el8_10.6
redhat/gnutls(Red Hat:rhel_aus:8.4) < 3.6.14-10.el8_4.1 3.6.14-10.el8_4.1
redhat/libtasn1(Red Hat:rhel_aus:8.4) < 4.13-3.el8_4.1 4.13-3.el8_4.1
redhat/gnutls(Red Hat:rhel_eus_long_life:8.4) < 3.6.14-10.el8_4.1 3.6.14-10.el8_4.1
redhat/libtasn1(Red Hat:rhel_eus_long_life:8.4) < 4.13-3.el8_4.1 4.13-3.el8_4.1
redhat/gnutls(Red Hat:rhel_aus:8.6) < 3.6.16-5.el8_6.5 3.6.16-5.el8_6.5
redhat/libtasn1(Red Hat:rhel_aus:8.6) < 4.13-3.el8_6.2 4.13-3.el8_6.2
redhat/gnutls(Red Hat:rhel_eus_long_life:8.6) < 3.6.16-5.el8_6.5 3.6.16-5.el8_6.5
redhat/libtasn1(Red Hat:rhel_eus_long_life:8.6) < 4.13-3.el8_6.2 4.13-3.el8_6.2
redhat/gnutls(Red Hat:rhel_tus:8.8) < 3.6.16-7.el8_8.4 3.6.16-7.el8_8.4
redhat/libtasn1(Red Hat:rhel_tus:8.8) < 4.13-4.el8_8.1 4.13-4.el8_8.1
redhat/gnutls(Red Hat:rhel_e4s:8.8) < 3.6.16-7.el8_8.4 3.6.16-7.el8_8.4
redhat/libtasn1(Red Hat:rhel_e4s:8.8) < 4.13-4.el8_8.1 4.13-4.el8_8.1
redhat/gnutls(Red Hat:enterprise_linux:9) < 3.8.10-4.el9_8 3.8.10-4.el9_8
redhat/gnutls(Red Hat:rhel_e4s:9.2) < 3.7.6-21.el9_2.7 3.7.6-21.el9_2.7
redhat/gnutls(Red Hat:rhel_e4s:9.4) < 3.8.3-4.el9_4.6 3.8.3-4.el9_4.6
redhat/gnutls(Red Hat:rhel_eus:9.6) < 3.8.3-6.el9_6.4 3.8.3-6.el9_6.4
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.12::el8) < 8:412.86.202608241157-0 8:412.86.202608241157-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.13::el9) < 9:413.92.202611041925-0 9:413.92.202611041925-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.14::el9) < 9:414.92.202611040941-0 9:414.92.202611040941-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.16::el9) < 9:416.94.202608150307-0 9:416.94.202608150307-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.17::el9) < 9:417.94.202608250221-0 9:417.94.202608250221-0
Show 117 more
ProductAffected versionsFixed in
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.18::el9) < 9:418.94.202608142238-0 9:418.94.202608142238-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.19::el9) < 9:4.19.9.6.202607151909-0 9:4.19.9.6.202607151909-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.20::el9) < 9:4.20.9.6.202610242033-0 9:4.20.9.6.202610242033-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.21::el9) < 9:4.21.9.6.202610241345-0 9:4.21.9.6.202610241345-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.22::el9) < 9:4.22.9.8.202610241758-0 9:4.22.9.8.202610241758-0
redhat/cert-manager/jetstack-cert-manager-acmesolver-rhel9:1791371080(Red Hat:cert_manager:1.17::el9) All versions No fix listed
redhat/cert-manager/jetstack-cert-manager-rhel9:1791371069(Red Hat:cert_manager:1.17::el9) All versions No fix listed
redhat/cert-manager/cert-manager-operator-rhel9:1791788287(Red Hat:cert_manager:1.17::el9) All versions No fix listed
redhat/cert-manager/cert-manager-operator-bundle:1791970484(Red Hat:cert_manager:1.17::el9) All versions No fix listed
redhat/cert-manager/jetstack-cert-manager-acmesolver-rhel9:1791459707(Red Hat:cert_manager:1.18::el9) All versions No fix listed
redhat/cert-manager/jetstack-cert-manager-rhel9:1791459711(Red Hat:cert_manager:1.18::el9) All versions No fix listed
redhat/cert-manager/cert-manager-istio-csr-rhel9:1791459759(Red Hat:cert_manager:1.18::el9) All versions No fix listed
redhat/cert-manager/cert-manager-operator-rhel9:1789029076(Red Hat:cert_manager:1.18::el9) All versions No fix listed
redhat/cert-manager/cert-manager-operator-bundle:1791966259(Red Hat:cert_manager:1.18::el9) All versions No fix listed
redhat/cert-manager/cert-manager-trust-manager-rhel9:1790598593(Red Hat:cert_manager:1.20::el9) All versions No fix listed
redhat/discovery/discovery-server-rhel9:1782159791(Red Hat:discovery:2::el9) All versions No fix listed
redhat/discovery/discovery-ui-rhel9:1782166952(Red Hat:discovery:2::el9) All versions No fix listed
redhat/gnutls-main(Red Hat:hummingbird:1) < 3.8.13-1.hum1 3.8.13-1.hum1
redhat/rhai/base-image-neuron-rhel9:1790703542(Red Hat:openshift_ai:3.4::el9) All versions No fix listed
redhat/rhui5/cds-rhel9:1781525684(Red Hat:rhui:5::el9) All versions No fix listed
redhat/rhui5/haproxy-rhel9:1781525671(Red Hat:rhui:5::el9) All versions No fix listed
redhat/rhui5/installer-rhel9:1781525693(Red Hat:rhui:5::el9) All versions No fix listed
redhat/rhui5/rhua-rhel9:1781525739(Red Hat:rhui:5::el9) All versions No fix listed
redhat/rhui5/cds-kubernetes-tp-rhel9:1787241211(Red Hat:rhui:5::el9) All versions No fix listed
redhat/rhui5/installer-tp-rhel9:1787135742(Red Hat:rhui:5::el9) All versions No fix listed
redhat/rhui5/rhua-tp-rhel9:1787241260(Red Hat:rhui:5::el9) All versions No fix listed
redhat/openshift/ose-rhel-coreos-9(Red Hat:openshift:5) All versions No fix listed
ubuntu/gnutls28(Ubuntu:22.04) < 3.7.3-4ubuntu1.9 3.7.3-4ubuntu1.9
alpine/gnutls(Alpine:v3.20) < 3.8.13-r0 3.8.13-r0
alpine/gnutls(Alpine:v3.21) < 3.8.13-r0 3.8.13-r0
alpine/gnutls(Alpine:v3.22) < 3.8.13-r0 3.8.13-r0
alpine/gnutls(Alpine:v3.23) < 3.8.13-r0 3.8.13-r0
alpine/gnutls(Alpine:v3.24) < 3.8.13-r0 3.8.13-r0
ubuntu/gnutls28(Ubuntu:24.04) < 3.8.3-1.1ubuntu3.6 3.8.3-1.1ubuntu3.6
ubuntu/gnutls28(Ubuntu:26.04) < 3.8.12-2ubuntu1.1 3.8.12-2ubuntu1.1
gnutls = 0 No fix listed
redhat enterprise linux < 0:3.8.10-4.el10_2 0:3.8.10-4.el10_2
redhat enterprise linux eus < 0:3.8.9-9.el10_0.19 0:3.8.9-9.el10_0.19
redhat rhel els < 0:3.3.29-9.el7_9.2 0:3.3.29-9.el7_9.2
redhat enterprise linux < 0:3.6.16-8.el8_10.6 0:3.6.16-8.el8_10.6
redhat rhel aus < 0:3.6.14-10.el8_4.1 0:3.6.14-10.el8_4.1
redhat rhel eus long life < 0:3.6.14-10.el8_4.1 0:3.6.14-10.el8_4.1
redhat rhel aus < 0:4.13-3.el8_4.1 0:4.13-3.el8_4.1
redhat rhel eus long life < 0:4.13-3.el8_4.1 0:4.13-3.el8_4.1
redhat rhel aus < 0:3.6.16-5.el8_6.5 0:3.6.16-5.el8_6.5
redhat rhel eus long life < 0:3.6.16-5.el8_6.5 0:3.6.16-5.el8_6.5
redhat rhel aus < 0:4.13-3.el8_6.2 0:4.13-3.el8_6.2
redhat rhel eus long life < 0:4.13-3.el8_6.2 0:4.13-3.el8_6.2
redhat rhel e4s < 0:3.6.16-7.el8_8.4 0:3.6.16-7.el8_8.4
redhat rhel tus < 0:3.6.16-7.el8_8.4 0:3.6.16-7.el8_8.4
redhat rhel e4s < 0:4.13-4.el8_8.1 0:4.13-4.el8_8.1
redhat rhel tus < 0:4.13-4.el8_8.1 0:4.13-4.el8_8.1
redhat enterprise linux < 0:3.8.10-4.el9_8 0:3.8.10-4.el9_8
redhat rhel e4s < 0:3.7.6-21.el9_2.7 0:3.7.6-21.el9_2.7
redhat rhel e4s < 0:3.8.3-4.el9_4.6 0:3.8.3-4.el9_4.6
redhat rhel eus < 0:3.8.3-6.el9_6.4 0:3.8.3-6.el9_6.4
redhat openshift < 412.86.202608241157-0 412.86.202608241157-0
redhat openshift < 413.92.202611041925-0 413.92.202611041925-0
redhat openshift < 414.92.202611040941-0 414.92.202611040941-0
redhat openshift < 415.92.202611051005-0 415.92.202611051005-0
redhat openshift < 416.94.202608150307-0 416.94.202608150307-0
redhat openshift < 417.94.202608250221-0 417.94.202608250221-0
redhat openshift < 418.94.202608142238-0 418.94.202608142238-0
redhat openshift < 4.19.9.6.202607151909-0 4.19.9.6.202607151909-0
redhat openshift < 4.20.9.6.202610242033-0 4.20.9.6.202610242033-0
redhat openshift < 4.21.9.6.202610241345-0 4.21.9.6.202610241345-0
redhat openshift < 4.22.9.8.202610241758-0 4.22.9.8.202610241758-0
redhat cert manager < 1791371080 1791371080
redhat cert manager < 1791371069 1791371069
redhat cert manager < 1791788287 1791788287
redhat cert manager < 1791970484 1791970484
redhat cert manager < 1791459707 1791459707
redhat cert manager < 1791459711 1791459711
redhat cert manager < 1791459759 1791459759
redhat cert manager < 1789029076 1789029076
redhat cert manager < 1791966259 1791966259
redhat cert manager < 1790598593 1790598593
redhat discovery < 1782159791 1782159791
redhat discovery < 1782166952 1782166952
redhat hummingbird < 3.8.13-1.hum1 3.8.13-1.hum1
redhat openshift ai < 1790703542 1790703542
redhat rhui < 1781525684 1781525684
redhat rhui < 1781525671 1781525671
redhat rhui < 1781525693 1781525693
redhat rhui < 1781525739 1781525739
redhat rhui < 1787241211 1787241211
redhat rhui < 1787135742 1787135742
redhat rhui < 1787241260 1787241260
redhat rhel els = 6 No fix listed
redhat openshift = 4 No fix listed
redhat openshift All versions No fix listed
debian/gnutls28(Debian:12) < 3.7.9-2+deb12u7 3.7.9-2+deb12u7
debian/gnutls28(Debian:12) = 3.7.9-2 No fix listed
debian/gnutls28(Debian:12) = 3.7.9-2+deb12u1 No fix listed
debian/gnutls28(Debian:12) = 3.7.9-2+deb12u2 No fix listed
debian/gnutls28(Debian:12) = 3.7.9-2+deb12u3 No fix listed
debian/gnutls28(Debian:12) = 3.7.9-2+deb12u4 No fix listed
debian/gnutls28(Debian:12) = 3.7.9-2+deb12u5 No fix listed
debian/gnutls28(Debian:12) = 3.7.9-2+deb12u6 No fix listed
debian/gnutls28(Debian:13) < 3.8.9-3+deb13u4 3.8.9-3+deb13u4
debian/gnutls28(Debian:13) = 3.8.9-3 No fix listed
debian/gnutls28(Debian:13) = 3.8.9-3+deb13u1 No fix listed
debian/gnutls28(Debian:13) = 3.8.9-3+deb13u2 No fix listed
debian/gnutls28(Debian:13) = 3.8.9-3+deb13u3 No fix listed
debian/gnutls28(Debian:14) < 3.8.13-1 3.8.13-1
debian/gnutls28(Debian:14) = 3.8.10-1 No fix listed
debian/gnutls28(Debian:14) = 3.8.10-2 No fix listed
debian/gnutls28(Debian:14) = 3.8.10-3 No fix listed
debian/gnutls28(Debian:14) = 3.8.11-1 No fix listed
debian/gnutls28(Debian:14) = 3.8.11-2 No fix listed
debian/gnutls28(Debian:14) = 3.8.11-3 No fix listed
debian/gnutls28(Debian:14) = 3.8.12-1 No fix listed
debian/gnutls28(Debian:14) = 3.8.12-2 No fix listed
debian/gnutls28(Debian:14) = 3.8.12-3 No fix listed
debian/gnutls28(Debian:14) = 3.8.12-4 No fix listed
debian/gnutls28(Debian:14) = 3.8.9-3 No fix listed
azure linux gnutls(Azure Linux:3.0) All versions No fix listed

References