ZeroDay Findings
Sign inSign up

Findings

CVE-2026-42013

A flaw was found in gnutls.

Published May 26, 2026 · updated Oct 14, 2026

A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks.

Timeline

Detection, updates, and resolution for this record.

  1. May 26, 2026 · NIST NVD

    Detected

    A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks.

  2. Oct 14, 2026 · NIST NVD

    Updated

    A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks.

  3. Oct 14, 2026 · NIST NVD

    Updated

    A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks.

Sources

  • CVE.orgCVE-2026-42013

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2026-42013

    30-day exploitation probability 0.6%

    first.org
  • NIST NVDCVE-2026-42013

    A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, po

    nvd.nist.gov

References