CVE-2026-42013Patch

LOWCVSS 8.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-295

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
3 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
General: 1 classified signal
Disclosure: 1 classified signal
Peaked 2d ago at 1 mentions (2026-05-12); latest day: 1
3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d

Signal classification3 categories

Patch

133.3%

General

133.3%

Disclosure

133.3%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-12	1	Patch1
2026-05-27	1	General1
2026-06-18	1	Disclosure1

Full discourse3 posts

إبراهيم بوحيمد | Ibrahim Buhaimed@buhaimedi134d
General
صدرت اليوم ٨ ثغرات بتصنيف حرج او عالي الخطورة في مكتبة GnuTLS الي شرحتها في التغريده المقتبسه ـ📍 (CVE-2026-42010) تقييم (NVD): 🔴 9.8 (حرجة) تقييم (Red Hat): 🟠 7.1 (عالية) ـ📍 (CVE-2026-33845) تقييم (NVD): 🔴 9.1 (حرجة) تقييم (Red Hat): 🟠 7.5 (عالية) ـ📍 (CVE-2026-42013) تقييم (Red Hat): 🟠 8.2 (عالية) تصنيف (GnuTLS) الرسمي: 🟡 (متوسطة) ـ📍 (CVE-2026-5260) تقييم (Red Hat): 🟠 8.2 (عالية) ـ📍 (CVE-2026-33846) تقييم (Red Hat): 🟠 7.5 (عالية) ـ📍 (CVE-2026-42009) تقييم (Red Hat): 🟠 7.5 (عالية) ـ📍 (CVE-2026-3833) تقييم (NVD): 🟠 7.4 (عالية) تقييم (Red Hat): 🟡 6.5 (متوسطة) ـ📍 (CVE-2026-42011) تقييم (Red Hat / Ubuntu CVSS): 🟠 7.4 (عالية) أولوية (Ubuntu) الفعلية: 🟡 (متوسطة)
Post summary
The tweet lists eight GnuTLS CVEs along with their NVD and Red Hat CVSS scores, but it provides no information about PoCs, exploitation, patches, or false‑positive claims. The content is limited to severity metrics.
03023124.3K
50.0K followersView on X
iototsecnews@iototsecnews150d
Patch
GnuTLS 3.8.13 リリース：認証バイパスとメモリ破損を含む複数の脆弱性を修正 https://iototsecnews.jp/2026/05/05/gnutls-3-8-13-released-with-fix-for-12-vulnerabilities-affecting-network-communications/ 今回のアップデートでは、メモリ管理の不備や認証処理のロジックミスを原因とする脆弱性が修正されています。具体的には、メモリの境界チェックが不足していたために発生する、CVE-2026-33846 や CVE-2026-33845 などのヒープ関連の脆弱性が修正されています。また、ユーザー名処理の不備からログインを許してしまう CVE-2026-42010 などの、プログラムが想定外の入力に対して正しく振る舞えない問題も対処されています。特に、DTLS の実装や証明書検証 (CVE-2026-42013) といった通信の根幹に関わる部分で、境界値の確認やポインタの扱い、名前の照合ルールが不十分であったことが、深刻なリスクを生むきっかけとなっています。ご利用のチームは、ご注意ください。 #CVE202633845 #CVE202633846 #CVE20263833 #CVE202642009 #CVE202642010 #CVE202642013 #CVE202642014 #CVE20265419 #GnuTLS #Vulnerability
Post summary
The GnuTLS 3.8.13 update releases a patch fixing several CVEs related to memory management and authentication, with technical details provided but no evidence of active exploitation or PoC code.
01000113
491 followersView on X
WindowsForum@windowsforum112d
Disclosure
🪟 Microsoft quietly flags a GnuTLS cert-validation fallback bug: an oversized SAN can make apps “trust the Common Name.” Great. Because nothing says secure like downgrading validation. Administrators, pay attention. #Windows #Microsoft #CVE #Security https://windowsforum.com/threads/cve-2026-42013-gnutls-tls-bug-certificate-validation-fallback-risk.427649/?utm_source=x&utm_medium=social&utm_campaign=news_node84 https://t.co/1o6UBCemou
Post summary
Microsoft has publicly identified a GnuTLS certificate validation fallback bug where an oversized SAN leads to apps trusting the Common Name, but no exploit or patch details are provided.
0000042
1.2K followersView on X

Explore more

Back to dashboard