CVE-2026-42013 Gnutls: gnutls: certificate validation bypass due to oversized subject alternative name
Remote attackers can bypass certificate validation via oversized Subject Alternative Names, enabling spoofing and man-in-the-middle attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42013?
CVE-2026-42013 is a high-severity vulnerability in Cert Manager support for Red Hat OpenShift release 1.17, published on 26 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks.
Weakness: CWE-295
Which versions are affected by CVE-2026-42013?
How do I fix CVE-2026-42013?
Apply the vendor's patch.
Is CVE-2026-42013 being exploited?
There is no known exploitation of CVE-2026-42013 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-42013, AZL-89178, BELL-CVE-2026-42013, DEBIAN-CVE-2026-42013, ECHO-0a73-78d8-34d4, GHSA-2pw7-g86g-76q7.