CVE-2026-42012

Name	CVE-2026-42012
Description	A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform Resource Identifier (URI) or Service (SRV) Subject Alternative Names (SANs). This could cause the certificate validation process to incorrectly fall back to checking DNS hostnames against the Common Name (CN), potentially allowing the attacker to spoof legitimate services or intercept sensitive information.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-4595-1, DSA-6281-1
Debian Bugs	1135319

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
gnutls28 (PTS)	bullseye	3.7.1-5+deb11u5	vulnerable
	bullseye (security)	3.7.1-5+deb11u10	fixed
	bookworm	3.7.9-2+deb12u6	vulnerable
	bookworm (security)	3.7.9-2+deb12u7	fixed
	trixie	3.8.9-3+deb13u3	vulnerable
	trixie (security)	3.8.9-3+deb13u4	fixed
	forky, sid	3.8.13-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
gnutls28	source	bullseye	3.7.1-5+deb11u10	DLA-4595-1
gnutls28	source	bookworm	3.7.9-2+deb12u7	DSA-6281-1
gnutls28	source	trixie	3.8.9-3+deb13u4	DSA-6281-1
gnutls28	source	(unstable)	3.8.13-1		1135319

Notes

https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-7
https://gitlab.com/gnutls/gnutls/-/issues/1802
Fixed by: https://gitlab.com/gnutls/gnutls/-/commit/8dcc6a1f48945997666ac9f10896819edd01a03b (3.8.13)