CVE-2026-42010

A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.

This vulnerability is rated as an Important severity flaw because an unauthenticated remote attacker could circumvent authentication mechanisms on exposed TLS endpoints, compromising access control and potentially gaining unauthorized access. Exploitation requires servers to be explicitly set up with RSA Pre-Shared Key (RSA-PSK) key exchange, which is an uncommon configuration that is not enabled by default across standard Red Hat deployments. Deployments utilizing standard certificate-based authentication or public key infrastructure remain unaffected by this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.