CVE-2026-42002

HighCVSS 7.5/10Last modified Jul 23, 2026

Description

Concurrency and locking defects in GSS-TSIG

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-364

Affected software

No affected versions have been published.

Timeline

Published
May 21, 2026
Last modified
Jul 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-420043.7An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT recorCVE-2026-420054.3An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. TheCVE-2026-420064.3An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking onCVE-2026-420079.1An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing CVE-2026-420084.3Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a vaCVE-2026-420097.5A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logicCVE-2026-42017.3A weakness has been identified in glowxq glowxq-oj up to 6f7c723090472057252040fd2bbbdaa1b5ed2393. This vulnerability affects the function UCVE-2026-420109.8A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containingCVE-2026-420117.4A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate CVE-2026-420127.1A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains UCVE-2026-420138.2A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to CVE-2026-420146.6A flaw was found in GnuTLS. The `gnutls_pkcs11_token_set_pin` function, used for changing the Security Officer PIN, can lead to a use-after-
CVE-2026-42002: High severity, CVSS 7.5 | Vulnix