CVE-2026-42013: Gnutls: gnutls: certificate validation bypass due to oversized subject alternative name
A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks.
Other sources
Gnutls: gnutls: certificate validation bypass due to oversized subject alternative name
— Microsoft
libgnutls: Suppress CN fallback for oversized SAN Validation of certificates with oversized Subject Alternative Names no longer falls back to checking DNS hostnames against Common Name.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.8.13-1 - Upgrade
Upgrade
debian/gnutls28to a version that resolves this vulnerability.Fixed in 3.7.1-5+deb11u10Fixed in 3.7.9-2+deb12u7Fixed in 3.8.9-3+deb13u4Fixed in 3.8.13-1 - Compensating control
Since oversized Subject Alternative Names can cause certificate validation to incorrectly fall back to the Common Name (CN), ensure clients reject or properly handle oversized SANs rather than allowing CN fallback during validation.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42013?
The severity of CVE-2026-42013 is rated as high with a score of 8.2.
How do I fix CVE-2026-42013?
To fix CVE-2026-42013, upgrade to the latest version of gnutls where the vulnerability is patched.
What systems are affected by CVE-2026-42013?
CVE-2026-42013 affects systems using gnutls version in Debian, specifically related to certificate validation.
What impact does CVE-2026-42013 have?
CVE-2026-42013 may allow a remote attacker to bypass proper certificate validation through oversized Subject Alternative Name fields.
When was CVE-2026-42013 published?
CVE-2026-42013 was published on May 26, 2026.