CVE-2026-42012
GnuTLS Certificate Validation Bypass via SAN Fallback
Publication date: 2026-05-26
Last updated on: 2026-05-26
Assigner: Red Hat, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gnutls | gnutls | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-295 | The product does not validate, or incorrectly validates, a certificate. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in gnutls and involves the certificate validation process. A remote attacker can exploit it by presenting a specially crafted certificate containing URI or SRV Subject Alternative Names (SANs). Due to the flaw, the validation process may incorrectly fall back to checking DNS hostnames against the Common Name (CN) field, which can lead to improper validation.
As a result, the attacker might be able to spoof legitimate services or intercept sensitive information by exploiting this incorrect certificate validation behavior.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing a remote attacker to spoof legitimate services or intercept sensitive information. Because the certificate validation process may incorrectly validate malicious certificates, attackers could impersonate trusted services, potentially leading to data interception or man-in-the-middle attacks.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability in gnutls could allow an attacker to spoof legitimate services or intercept sensitive information by exploiting certificate validation flaws.
Such interception or spoofing of sensitive information may lead to violations of data protection regulations like GDPR or HIPAA, which require the protection of personal and sensitive data during transmission.
Therefore, if exploited, this vulnerability could negatively impact compliance with these standards by compromising the confidentiality and integrity of data.