CVE-2026-42011 Gnutls: gnutls: security bypass due to incorrect name constraint handling
Remote attackers can bypass certificate name constraints in GnuTLS, enabling spoofing or man-in-the-middle attacks against systems using affected versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42011?
CVE-2026-42011 is a high-severity vulnerability in Cert Manager support for Red Hat OpenShift release 1.17, published on 7 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint checks during certificate validation. This bypass could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle attacks against affected systems.
Weakness: CWE-295
Which versions are affected by CVE-2026-42011?
How do I fix CVE-2026-42011?
Apply the vendor's patch.
Is CVE-2026-42011 being exploited?
There is no known exploitation of CVE-2026-42011 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-42011, BELL-CVE-2026-42011, CLSA-2026-1791496727, CLSA-2026-1791497467, CLSA-2026-1791497901, DEBIAN-CVE-2026-42011 and 2 more.