Gnutls: gnutls: security bypass due to incorrect name constraint handling

Description

A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint checks during certificate validation. This bypass could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle attacks against affected systems.

Timeline

Scores

EPSS (exploitation in 30 days)

0.47% · top 59% of all CVEs (10 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.4.

Affected products

• gnutls

  • affected 0

• Red Hat · Red Hat Enterprise Linux 10

  • unaffected 0:3.8.10-4.el10_2 – < *

• Red Hat · Red Hat Enterprise Linux 10.0 Extended Update Support

  • unaffected 0:3.8.9-9.el10_0.19 – < *

• Red Hat · Red Hat Enterprise Linux 7 Extended Lifecycle Support

  • unaffected 0:3.3.29-9.el7_9.2 – < *

• Red Hat · Red Hat Enterprise Linux 8

  • unaffected 0:3.6.16-8.el8_10.6 – < *

• Red Hat · Red Hat Enterprise Linux 8

  • unaffected 0:3.6.16-8.el8_10.6 – < *

• Red Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

  • unaffected 0:3.6.14-10.el8_4.1 – < *

• Red Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

  • unaffected 0:4.13-3.el8_4.1 – < *

• Red Hat · Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

  • unaffected 0:3.6.14-10.el8_4.1 – < *

• Red Hat · Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

  • unaffected 0:4.13-3.el8_4.1 – < *

• Red Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

  • unaffected 0:3.6.16-5.el8_6.5 – < *

• Red Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

  • unaffected 0:4.13-3.el8_6.2 – < *

• Red Hat · Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

  • unaffected 0:3.6.16-5.el8_6.5 – < *

• Red Hat · Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

  • unaffected 0:4.13-3.el8_6.2 – < *

• Red Hat · Red Hat Enterprise Linux 8.8 Telecommunications Update Service

  • unaffected 0:3.6.16-7.el8_8.4 – < *

• Red Hat · Red Hat Enterprise Linux 8.8 Telecommunications Update Service

  • unaffected 0:4.13-4.el8_8.1 – < *

• Red Hat · Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions

  • unaffected 0:3.6.16-7.el8_8.4 – < *

• Red Hat · Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions

  • unaffected 0:4.13-4.el8_8.1 – < *

• Red Hat · Red Hat Enterprise Linux 9

  • unaffected 0:3.8.10-4.el9_8 – < *

• Red Hat · Red Hat Enterprise Linux 9

  • unaffected 0:3.8.10-4.el9_8 – < *

• Red Hat · Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

  • unaffected 0:3.7.6-21.el9_2.7 – < *

• Red Hat · Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

  • unaffected 0:3.8.3-4.el9_4.6 – < *

• Red Hat · Red Hat Enterprise Linux 9.6 Extended Update Support

  • unaffected 0:3.8.3-6.el9_6.4 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.12

  • unaffected 412.86.202608241157-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.14

  • unaffected 414.92.202611040941-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.16

  • unaffected 416.94.202608150307-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.17

  • unaffected 417.94.202608250221-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.18

  • unaffected 418.94.202608142238-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.19

  • unaffected 4.19.9.6.202607151909-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.20

  • unaffected 4.20.9.6.202610242033-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.21

  • unaffected 4.21.9.6.202610241345-0 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.22

  • unaffected 4.22.9.8.202610241758-0 – < *

• Red Hat · Cert Manager support for Red Hat OpenShift release 1.17

  • unaffected 1791371080 – < *

• Red Hat · Cert Manager support for Red Hat OpenShift release 1.17

  • unaffected 1791371069 – < *

• Red Hat · Cert Manager support for Red Hat OpenShift release 1.17

  • unaffected 1791788287 – < *

• Red Hat · Cert Manager support for Red Hat OpenShift release 1.17

  • unaffected 1791970484 – < *

• Red Hat · Cert Manager support for Red Hat OpenShift release 1.18

  • unaffected 1791459707 – < *

• Red Hat · Cert Manager support for Red Hat OpenShift release 1.18

  • unaffected 1791459711 – < *

• Red Hat · Cert Manager support for Red Hat OpenShift release 1.18

  • unaffected 1791459759 – < *

• Red Hat · Cert Manager support for Red Hat OpenShift release 1.18

  • unaffected 1789029076 – < *

• Red Hat · Cert Manager support for Red Hat OpenShift release 1.18

  • unaffected 1791966259 – < *

• Red Hat · Cert Manager support for Red Hat OpenShift release 1.20

  • unaffected 1790598593 – < *

• Red Hat · Red Hat Discovery 2

  • unaffected 1782159791 – < *

• Red Hat · Red Hat Discovery 2

  • unaffected 1782166952 – < *

• Red Hat · Red Hat Hardened Images

  • unaffected 3.8.13-1.hum1 – < *

• Red Hat · Red Hat OpenShift AI 3.4

  • unaffected 1790703542 – < *

• Red Hat · Red Hat Update Infrastructure 5

  • unaffected 1781525684 – < *

• Red Hat · Red Hat Update Infrastructure 5

  • unaffected 1781525671 – < *

• Red Hat · Red Hat Update Infrastructure 5

  • unaffected 1781525693 – < *

• Red Hat · Red Hat Update Infrastructure 5

  • unaffected 1781525739 – < *

• Red Hat · Red Hat Update Infrastructure 5

  • unaffected 1787241211 – < *

• Red Hat · Red Hat Update Infrastructure 5

  • unaffected 1787135742 – < *

• Red Hat · Red Hat Update Infrastructure 5

  • unaffected 1787241260 – < *

• Red Hat · Red Hat Enterprise Linux 6

  All versions: unaffected

• Red Hat · Red Hat OpenShift Container Platform 4

  All versions: unaffected

• Red Hat · Red Hat OpenShift Container Platform 5

  All versions: affected

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-28386 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-42011](https://cveledger.app/badge/CVE-2026-42011.svg)](https://cveledger.app/cve/CVE-2026-42011)

Record last updated 9 Nov 2026, 17:14 UTC.