CVE-2026-42010: Gnutls: gnutls: authentication bypass via nul character in username
A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.
Other sources
Gnutls: gnutls: authentication bypass via nul character in username
— Microsoft
libgnutls: Servers configured with RSA-PSK have wrongfully matched usernames with NUL character in them to ones truncated to NUL character, which could lead to an authentication bypass. Fix the check to perform comparison up to the full username length. Reported by Joshua Rogers of AISLE Research Team. [GNUTLS-SA-2026-04-29-4, CVSS: high] [CVE-2026-42010]
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/gnutls28to a version that resolves this vulnerability.Fixed in 3.7.1-5+deb11u10Fixed in 3.7.9-2+deb12u7Fixed in 3.8.9-3+deb13u4Fixed in 3.8.13-1 - Configuration
Fix the authentication check to compare the entire provided username length; ensure usernames containing a NUL character are not treated as truncated at the NUL character (for RSA-PSK servers that incorrectly matched NUL-containing usernames).
GnuTLS (libgnutls) authentication code for RSA-PSK username comparison Username comparison length = Perform comparison up to the full username length (do not stop at NUL character) - Compensating control
Until the check is fixed, restrict access to the RSA-PSK authentication endpoints so only trusted clients can authenticate, reducing the chance of exploitation via crafted NUL-containing usernames.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42010?
CVE-2026-42010 is classified as a medium severity vulnerability due to the potential for authentication bypass.
How do I fix CVE-2026-42010?
To fix CVE-2026-42010, update to the latest version of GnuTLS that addresses this vulnerability.
What types of systems are affected by CVE-2026-42010?
CVE-2026-42010 affects systems using GnuTLS with RSA-PSK authentication configured to accept usernames.
Is CVE-2026-42010 remotely exploitable?
Yes, CVE-2026-42010 can be remotely exploited by attackers sending specially crafted usernames containing NUL characters.
What impact does CVE-2026-42010 have on user authentication?
CVE-2026-42010 allows attackers to bypass authentication processes, potentially granting unauthorized access to systems.