CVE-2026-42010: Gnutls: gnutls: authentication bypass via nul character in username
A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42010?
CVE-2026-42010 is classified as a medium severity vulnerability due to the potential for authentication bypass.
How do I fix CVE-2026-42010?
To fix CVE-2026-42010, update to the latest version of GnuTLS that addresses this vulnerability.
What types of systems are affected by CVE-2026-42010?
CVE-2026-42010 affects systems using GnuTLS with RSA-PSK authentication configured to accept usernames.
Is CVE-2026-42010 remotely exploitable?
Yes, CVE-2026-42010 can be remotely exploited by attackers sending specially crafted usernames containing NUL characters.
What impact does CVE-2026-42010 have on user authentication?
CVE-2026-42010 allows attackers to bypass authentication processes, potentially granting unauthorized access to systems.