CVE-2026-42015 Gnutls: gnutls: memory corruption due to off-by-one error in pkcs#12 bag handling
Remote attackers can trigger memory corruption via off-by-one error in PKCS#12 handling, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42015?
CVE-2026-42015 is a medium-severity memory corruption vulnerability in Cert Manager support for Red Hat OpenShift release 1.17, published on 26 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in gnutls. An off-by-one error exists in the PKCS#12 bag element bounds check. This vulnerability allows an remote attacker to write past the internal array of a PKCS#12 bag when appending to a bag that already contains 32 elements. This memory corruption could lead to a denial of service (DoS) or potentially other unspecified impacts.
Weakness: CWE-193
Which versions are affected by CVE-2026-42015?
How do I fix CVE-2026-42015?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-42015 being exploited?
There is no known exploitation of CVE-2026-42015 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-42015, AZL-89181, BELL-CVE-2026-42015, DEBIAN-CVE-2026-42015, ECHO-b507-5d7a-0c6f, GHSA-45p2-c2m2-2656.