CVE-2026-42011

HighCVSS 7.4/10Last modified Oct 14, 2026

Description

A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint checks during certificate validation. This bypass could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle attacks against affected systems.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-295

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: May 7, 2026
Last modified: Oct 14, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-420127.1A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains U CVE-2026-420138.2A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to CVE-2026-420146.6A flaw was found in GnuTLS. The `gnutls_pkcs11_token_set_pin` function, used for changing the Security Officer PIN, can lead to a use-after-CVE-2026-420155.3A flaw was found in gnutls. An off-by-one error exists in the PKCS#12 bag element bounds check. This vulnerability allows an remote attacker CVE-2026-420168.8JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the to CVE-2026-420178.8An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged user under specific con CVE-2026-420187.5JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially CVE-2026-420199.1Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-G CVE-2026-42024.3The extension fails to verify, if an authenticated user has permissions to access to redirects resulting in exposure of redirect records whe CVE-2026-420209.1Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-G CVE-2026-420219.1Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X CVE-2026-420229.1Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X