CVE-2026-42010 HIGH

CVE-2026-42010: Gnutls: gnutls: authentication bypass via nul character in username

Vendor Red Hat
Product Red Hat Enterprise Linux 6
Weakness CWE-170
Published May 7, 2026
Last update June 30, 2026

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

What the vulnerability does

01Description

A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.

Key dates

02Disclosure timeline

May 7, 2026 CVE published
June 30, 2026 Record updated