CVE-2026-42010

A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.
References
Link Resource
https://access.redhat.com/errata/RHSA-2026:13274
https://access.redhat.com/errata/RHSA-2026:20611
https://access.redhat.com/errata/RHSA-2026:20612
https://access.redhat.com/errata/RHSA-2026:20613
https://access.redhat.com/errata/RHSA-2026:26319
https://access.redhat.com/errata/RHSA-2026:26409
https://access.redhat.com/errata/RHSA-2026:29197
https://access.redhat.com/errata/RHSA-2026:30004
https://access.redhat.com/errata/RHSA-2026:30849
https://access.redhat.com/errata/RHSA-2026:30850
https://access.redhat.com/errata/RHSA-2026:32962
https://access.redhat.com/errata/RHSA-2026:33125
https://access.redhat.com/errata/RHSA-2026:34764
https://access.redhat.com/errata/RHSA-2026:34788
https://access.redhat.com/errata/RHSA-2026:34790
https://access.redhat.com/errata/RHSA-2026:36004
https://access.redhat.com/errata/RHSA-2026:36005
https://access.redhat.com/errata/RHSA-2026:36006
https://access.redhat.com/errata/RHSA-2026:40762
https://access.redhat.com/errata/RHSA-2026:41921
https://access.redhat.com/errata/RHSA-2026:56853
https://access.redhat.com/errata/RHSA-2026:57483
https://access.redhat.com/errata/RHSA-2026:58981
https://access.redhat.com/errata/RHSA-2026:59831
https://access.redhat.com/errata/RHSA-2026:60019
https://access.redhat.com/errata/RHSA-2026:62409
https://access.redhat.com/errata/RHSA-2026:65839
https://access.redhat.com/errata/RHSA-2026:67857
https://access.redhat.com/errata/RHSA-2026:72502
https://access.redhat.com/errata/RHSA-2026:74674
https://access.redhat.com/errata/RHSA-2026:82304
https://access.redhat.com/errata/RHSA-2026:82322
https://access.redhat.com/errata/RHSA-2026:82347
https://access.redhat.com/errata/RHSA-2026:82354
https://access.redhat.com/errata/RHSA-2026:82372
https://access.redhat.com/errata/RHSA-2026:82857
https://access.redhat.com/errata/RHSA-2026:82888
https://access.redhat.com/security/cve/CVE-2026-42010 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2467289 Issue Tracking Vendor Advisory
https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-4
https://access.redhat.com/errata/RHSA-2026:13274
https://access.redhat.com/errata/RHSA-2026:20611
https://access.redhat.com/errata/RHSA-2026:20612
https://access.redhat.com/errata/RHSA-2026:20613
https://access.redhat.com/errata/RHSA-2026:26319
https://access.redhat.com/errata/RHSA-2026:26409
https://access.redhat.com/errata/RHSA-2026:29197
https://access.redhat.com/errata/RHSA-2026:30004
https://access.redhat.com/errata/RHSA-2026:30849
https://access.redhat.com/errata/RHSA-2026:30850
https://access.redhat.com/errata/RHSA-2026:32962
https://access.redhat.com/errata/RHSA-2026:33125
https://access.redhat.com/errata/RHSA-2026:34764
https://access.redhat.com/errata/RHSA-2026:34788
https://access.redhat.com/errata/RHSA-2026:34790
https://access.redhat.com/errata/RHSA-2026:36004
https://access.redhat.com/errata/RHSA-2026:36005
https://access.redhat.com/errata/RHSA-2026:36006
https://access.redhat.com/errata/RHSA-2026:40762
https://access.redhat.com/errata/RHSA-2026:41921
https://access.redhat.com/errata/RHSA-2026:56853
https://access.redhat.com/errata/RHSA-2026:57483
https://access.redhat.com/errata/RHSA-2026:58981
https://access.redhat.com/errata/RHSA-2026:59831
https://access.redhat.com/errata/RHSA-2026:60019
https://access.redhat.com/errata/RHSA-2026:62409
https://access.redhat.com/errata/RHSA-2026:65839
https://access.redhat.com/security/cve/CVE-2026-42010 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2467289 Issue Tracking Vendor Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42010.json
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:gnu:gnutls:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*

History

26 Oct 2026, 22:10

Type Values Removed Values Added
Summary
  • (es) Se encontró una falla en gnutls. Los servidores configurados con RSA-PSK (Rivest-Shamir-Adleman - Clave Precompartida) emparejaban incorrectamente nombres de usuario que contenían un carácter NUL con nombres de usuario truncados. Un atacante remoto podría explotar esto enviando un nombre de usuario especialmente diseñado, lo que lleva a una omisión de autenticación. Esta vulnerabilidad permite a un atacante obtener acceso no autorizado eludiendo el proceso de autenticación.

14 Oct 2026, 20:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:82857 -
  • () https://access.redhat.com/errata/RHSA-2026:82888 -

14 Oct 2026, 03:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:82304 -
  • () https://access.redhat.com/errata/RHSA-2026:82322 -
  • () https://access.redhat.com/errata/RHSA-2026:82347 -
  • () https://access.redhat.com/errata/RHSA-2026:82354 -
  • () https://access.redhat.com/errata/RHSA-2026:82372 -

02 Oct 2026, 03:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:74674 -

29 Sep 2026, 01:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:72502 -

28 Sep 2026, 02:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:67857 -

18 Sep 2026, 13:18

Type Values Removed Values Added
References () https://access.redhat.com/errata/RHSA-2026:65839 - () https://access.redhat.com/errata/RHSA-2026:65839 -

17 Sep 2026, 19:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:65839 -

Information

Published : 2026-05-07 12:16

Updated : 2026-10-30 17:17


NVD link : CVE-2026-42010

Mitre link : CVE-2026-42010

CVE.ORG link : CVE-2026-42010


JSON object : View

Products Affected

redhat

  • hardened_images
  • openshift_container_platform
  • enterprise_linux

gnu

  • gnutls
CWE
CWE-170

Improper Null Termination

CWE-626

Null Byte Interaction Error (Poison Null Byte)