Skip to content

CVE-2026-42012 Gnutls: gnutls: certificate validation bypass due to improper handling of uri and srv sans

HighCVSS 7.1 EPSS 0.37%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform Resource Identifier (URI) or Service (SRV) Subject Alternative Names (SANs). This could cause the certificate validation process to incorrectly fall back to checking DNS hostnames against the Common Name (CN), potentially allowing the attacker to spoof legitimate services or intercept sensitive information.

Affected products

ProductAffected versionsFixed in
gnutls = 0 No fix listed
redhat enterprise linux < 0:3.8.10-4.el10_2 0:3.8.10-4.el10_2
redhat enterprise linux eus < 0:3.8.9-9.el10_0.19 0:3.8.9-9.el10_0.19
redhat rhel els < 0:2.12.23-22.el6_10.1 0:2.12.23-22.el6_10.1
redhat rhel els < 0:3.3.29-9.el7_9.2 0:3.3.29-9.el7_9.2
redhat enterprise linux < 0:3.6.16-8.el8_10.6 0:3.6.16-8.el8_10.6
redhat rhel aus < 0:3.6.14-10.el8_4.1 0:3.6.14-10.el8_4.1
redhat rhel eus long life < 0:3.6.14-10.el8_4.1 0:3.6.14-10.el8_4.1
redhat rhel aus < 0:4.13-3.el8_4.1 0:4.13-3.el8_4.1
redhat rhel eus long life < 0:4.13-3.el8_4.1 0:4.13-3.el8_4.1
redhat rhel aus < 0:3.6.16-5.el8_6.5 0:3.6.16-5.el8_6.5
redhat rhel eus long life < 0:3.6.16-5.el8_6.5 0:3.6.16-5.el8_6.5
redhat rhel aus < 0:4.13-3.el8_6.2 0:4.13-3.el8_6.2
redhat rhel eus long life < 0:4.13-3.el8_6.2 0:4.13-3.el8_6.2
redhat rhel e4s < 0:3.6.16-7.el8_8.4 0:3.6.16-7.el8_8.4
redhat rhel tus < 0:3.6.16-7.el8_8.4 0:3.6.16-7.el8_8.4
redhat rhel e4s < 0:4.13-4.el8_8.1 0:4.13-4.el8_8.1
redhat rhel tus < 0:4.13-4.el8_8.1 0:4.13-4.el8_8.1
redhat enterprise linux < 0:3.8.10-4.el9_8 0:3.8.10-4.el9_8
redhat rhel e4s < 0:3.7.6-21.el9_2.7 0:3.7.6-21.el9_2.7
redhat rhel e4s < 0:3.8.3-4.el9_4.6 0:3.8.3-4.el9_4.6
redhat rhel eus < 0:3.8.3-6.el9_6.4 0:3.8.3-6.el9_6.4
redhat openshift < 4.20.9.6.202610242033-0 4.20.9.6.202610242033-0
redhat openshift < 4.21.9.6.202610241345-0 4.21.9.6.202610241345-0
redhat openshift < 4.22.9.8.202610241758-0 4.22.9.8.202610241758-0
Show 105 more
ProductAffected versionsFixed in
redhat cert manager < 1791371080 1791371080
redhat cert manager < 1791371069 1791371069
redhat cert manager < 1791788287 1791788287
redhat cert manager < 1791970484 1791970484
redhat cert manager < 1791459707 1791459707
redhat cert manager < 1791459711 1791459711
redhat cert manager < 1791459759 1791459759
redhat cert manager < 1789029076 1789029076
redhat cert manager < 1791966259 1791966259
redhat cert manager < 1790598593 1790598593
redhat discovery < 1782159791 1782159791
redhat discovery < 1782166952 1782166952
redhat hummingbird < 3.8.13-1.hum1 3.8.13-1.hum1
redhat openshift ai < 1790703542 1790703542
redhat rhui < 1781525684 1781525684
redhat rhui < 1781525671 1781525671
redhat rhui < 1781525693 1781525693
redhat rhui < 1781525739 1781525739
redhat rhui < 1787241211 1787241211
redhat rhui < 1787135742 1787135742
redhat rhui < 1787241260 1787241260
redhat openshift = 4 No fix listed
redhat openshift All versions No fix listed
debian/gnutls28(Debian:12) < 3.7.9-2+deb12u7 3.7.9-2+deb12u7
debian/gnutls28(Debian:12) = 3.7.9-2 No fix listed
debian/gnutls28(Debian:12) = 3.7.9-2+deb12u1 No fix listed
debian/gnutls28(Debian:12) = 3.7.9-2+deb12u2 No fix listed
debian/gnutls28(Debian:12) = 3.7.9-2+deb12u3 No fix listed
debian/gnutls28(Debian:12) = 3.7.9-2+deb12u4 No fix listed
debian/gnutls28(Debian:12) = 3.7.9-2+deb12u5 No fix listed
debian/gnutls28(Debian:12) = 3.7.9-2+deb12u6 No fix listed
debian/gnutls28(Debian:13) < 3.8.9-3+deb13u4 3.8.9-3+deb13u4
debian/gnutls28(Debian:13) = 3.8.9-3 No fix listed
debian/gnutls28(Debian:13) = 3.8.9-3+deb13u1 No fix listed
debian/gnutls28(Debian:13) = 3.8.9-3+deb13u2 No fix listed
debian/gnutls28(Debian:13) = 3.8.9-3+deb13u3 No fix listed
debian/gnutls28(Debian:14) < 3.8.13-1 3.8.13-1
debian/gnutls28(Debian:14) = 3.8.10-1 No fix listed
debian/gnutls28(Debian:14) = 3.8.10-2 No fix listed
debian/gnutls28(Debian:14) = 3.8.10-3 No fix listed
debian/gnutls28(Debian:14) = 3.8.11-1 No fix listed
debian/gnutls28(Debian:14) = 3.8.11-2 No fix listed
debian/gnutls28(Debian:14) = 3.8.11-3 No fix listed
debian/gnutls28(Debian:14) = 3.8.12-1 No fix listed
debian/gnutls28(Debian:14) = 3.8.12-2 No fix listed
debian/gnutls28(Debian:14) = 3.8.12-3 No fix listed
debian/gnutls28(Debian:14) = 3.8.12-4 No fix listed
debian/gnutls28(Debian:14) = 3.8.9-3 No fix listed
redhat/gnutls(Red Hat:enterprise_linux:10.2) < 3.8.10-4.el10_2 3.8.10-4.el10_2
redhat/gnutls(Red Hat:enterprise_linux_eus:10.0) < 3.8.9-9.el10_0.19 3.8.9-9.el10_0.19
redhat/gnutls(Red Hat:rhel_els:6) < 2.12.23-22.el6_10.1 2.12.23-22.el6_10.1
redhat/gnutls(Red Hat:rhel_els:7) < 3.3.29-9.el7_9.2 3.3.29-9.el7_9.2
redhat/gnutls(Red Hat:enterprise_linux:8) < 3.6.16-8.el8_10.6 3.6.16-8.el8_10.6
redhat/gnutls(Red Hat:rhel_aus:8.4) < 3.6.14-10.el8_4.1 3.6.14-10.el8_4.1
redhat/libtasn1(Red Hat:rhel_aus:8.4) < 4.13-3.el8_4.1 4.13-3.el8_4.1
redhat/gnutls(Red Hat:rhel_eus_long_life:8.4) < 3.6.14-10.el8_4.1 3.6.14-10.el8_4.1
redhat/libtasn1(Red Hat:rhel_eus_long_life:8.4) < 4.13-3.el8_4.1 4.13-3.el8_4.1
redhat/gnutls(Red Hat:rhel_aus:8.6) < 3.6.16-5.el8_6.5 3.6.16-5.el8_6.5
redhat/libtasn1(Red Hat:rhel_aus:8.6) < 4.13-3.el8_6.2 4.13-3.el8_6.2
redhat/gnutls(Red Hat:rhel_eus_long_life:8.6) < 3.6.16-5.el8_6.5 3.6.16-5.el8_6.5
redhat/libtasn1(Red Hat:rhel_eus_long_life:8.6) < 4.13-3.el8_6.2 4.13-3.el8_6.2
redhat/gnutls(Red Hat:rhel_tus:8.8) < 3.6.16-7.el8_8.4 3.6.16-7.el8_8.4
redhat/libtasn1(Red Hat:rhel_tus:8.8) < 4.13-4.el8_8.1 4.13-4.el8_8.1
redhat/gnutls(Red Hat:rhel_e4s:8.8) < 3.6.16-7.el8_8.4 3.6.16-7.el8_8.4
redhat/libtasn1(Red Hat:rhel_e4s:8.8) < 4.13-4.el8_8.1 4.13-4.el8_8.1
redhat/gnutls(Red Hat:enterprise_linux:9) < 3.8.10-4.el9_8 3.8.10-4.el9_8
redhat/gnutls(Red Hat:rhel_e4s:9.2) < 3.7.6-21.el9_2.7 3.7.6-21.el9_2.7
redhat/gnutls(Red Hat:rhel_e4s:9.4) < 3.8.3-4.el9_4.6 3.8.3-4.el9_4.6
redhat/gnutls(Red Hat:rhel_eus:9.6) < 3.8.3-6.el9_6.4 3.8.3-6.el9_6.4
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.20::el9) < 9:4.20.9.6.202610242033-0 9:4.20.9.6.202610242033-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.21::el9) < 9:4.21.9.6.202610241345-0 9:4.21.9.6.202610241345-0
redhat/openshift/ose-rhel-coreos(Red Hat:openshift:4.22::el9) < 9:4.22.9.8.202610241758-0 9:4.22.9.8.202610241758-0
redhat/cert-manager/jetstack-cert-manager-acmesolver-rhel9:1791371080(Red Hat:cert_manager:1.17::el9) All versions No fix listed
redhat/cert-manager/jetstack-cert-manager-rhel9:1791371069(Red Hat:cert_manager:1.17::el9) All versions No fix listed
redhat/cert-manager/cert-manager-operator-rhel9:1791788287(Red Hat:cert_manager:1.17::el9) All versions No fix listed
redhat/cert-manager/cert-manager-operator-bundle:1791970484(Red Hat:cert_manager:1.17::el9) All versions No fix listed
redhat/cert-manager/jetstack-cert-manager-acmesolver-rhel9:1791459707(Red Hat:cert_manager:1.18::el9) All versions No fix listed
redhat/cert-manager/jetstack-cert-manager-rhel9:1791459711(Red Hat:cert_manager:1.18::el9) All versions No fix listed
redhat/cert-manager/cert-manager-istio-csr-rhel9:1791459759(Red Hat:cert_manager:1.18::el9) All versions No fix listed
redhat/cert-manager/cert-manager-operator-rhel9:1789029076(Red Hat:cert_manager:1.18::el9) All versions No fix listed
redhat/cert-manager/cert-manager-operator-bundle:1791966259(Red Hat:cert_manager:1.18::el9) All versions No fix listed
redhat/cert-manager/cert-manager-trust-manager-rhel9:1790598593(Red Hat:cert_manager:1.20::el9) All versions No fix listed
redhat/discovery/discovery-server-rhel9:1782159791(Red Hat:discovery:2::el9) All versions No fix listed
redhat/discovery/discovery-ui-rhel9:1782166952(Red Hat:discovery:2::el9) All versions No fix listed
redhat/gnutls-main(Red Hat:hummingbird:1) < 3.8.13-1.hum1 3.8.13-1.hum1
redhat/rhai/base-image-neuron-rhel9:1790703542(Red Hat:openshift_ai:3.4::el9) All versions No fix listed
redhat/rhui5/cds-rhel9:1781525684(Red Hat:rhui:5::el9) All versions No fix listed
redhat/rhui5/haproxy-rhel9:1781525671(Red Hat:rhui:5::el9) All versions No fix listed
redhat/rhui5/installer-rhel9:1781525693(Red Hat:rhui:5::el9) All versions No fix listed
redhat/rhui5/rhua-rhel9:1781525739(Red Hat:rhui:5::el9) All versions No fix listed
redhat/rhui5/cds-kubernetes-tp-rhel9:1787241211(Red Hat:rhui:5::el9) All versions No fix listed
redhat/rhui5/installer-tp-rhel9:1787135742(Red Hat:rhui:5::el9) All versions No fix listed
redhat/rhui5/rhua-tp-rhel9:1787241260(Red Hat:rhui:5::el9) All versions No fix listed
redhat/openshift/ose-rhel-coreos-8(Red Hat:openshift:4) All versions No fix listed
redhat/openshift/ose-rhel-coreos-9(Red Hat:openshift:5) All versions No fix listed
ubuntu/gnutls28(Ubuntu:22.04) < 3.7.3-4ubuntu1.9 3.7.3-4ubuntu1.9
alpine/gnutls(Alpine:v3.20) < 3.8.13-r0 3.8.13-r0
alpine/gnutls(Alpine:v3.21) < 3.8.13-r0 3.8.13-r0
alpine/gnutls(Alpine:v3.22) < 3.8.13-r0 3.8.13-r0
alpine/gnutls(Alpine:v3.23) < 3.8.13-r0 3.8.13-r0
alpine/gnutls(Alpine:v3.24) < 3.8.13-r0 3.8.13-r0
ubuntu/gnutls28(Ubuntu:24.04) < 3.8.3-1.1ubuntu3.6 3.8.3-1.1ubuntu3.6
ubuntu/gnutls28(Ubuntu:26.04) < 3.8.12-2ubuntu1.1 3.8.12-2ubuntu1.1
azure linux gnutls(Azure Linux:3.0) All versions No fix listed
azure linux gnutls(Azure Linux:3.0) < 3.8.13-1 3.8.13-1

References