CVE-2026-42010 · AETERNAE Research

Disclosure summary

A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.

Source-reported weakness categories

CWE-170, CWE-626

Source-specific records & product guidance

Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.

NIST National Vulnerability Database · NVD-CVE-2026-42010

Open original source · Updated Oct 08, 2026

Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.

Vendor	Product / association	Version / bounds
gnu	gnutls	-
redhat	hardened_images	-
redhat	openshift_container_platform	4.0
redhat	enterprise_linux	6.0
redhat	enterprise_linux	7.0
redhat	enterprise_linux	8.0
redhat	enterprise_linux	9.0
redhat	enterprise_linux	10.0

Original records & references

PUBLISHED 2026-05-07T08:16:17-04:00
MODIFIED 2026-10-08T17:18:00-04:00
INGESTED 2026-10-10T20:50:35-04:00

CVE-2026-42010.

Disclosure summary

Source-reported weakness categories

Source-specific records & product guidance

Original records & references