CVE-2026-42010 @ Saiph

"CVE-2026-42010"
"gnutls-deb0-28-3.3.8-6+deb8u6"
"gnutls-openssl27-3.6.7-4+deb10u12)"
"gnutls-deb0-28"
"gnutls"
"Am I vulnerable?"

Status

not_applicable

Priority

2.43

Match score

3.0

Risk

AuthBypass Remote priv:user

CVSS

7.1 HIGH

Reason

cpe: gnutls; pkgs: gnutls-deb0-28, gnutls-openssl27; version: unknown (gnutls-deb0-28-3.3.8-6+deb8u6; gnutls-openssl27-3.6.7-4+deb10u12); risk:auth_bypass; remote

Created

2026-08-03T02:35:42Z

Updated

2026-08-22T10:15:30Z

Closed

2026-08-03T03:27:38Z

Package interrogation (copy)

Run on the host — click to copy a command. Debian/apt

Package	Commands
gnutls-deb0-28-3.3.8-6+deb8u6
gnutls-openssl27-3.6.7-4+deb10u12)
gnutls-deb0-28
gnutls

Inventory lookup

Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.

Suggestions: gnutls-deb0 · gnutls-openssl27 · gnutls · gnutls-deb0-28

System	Matches	Ticket for CVE-2026-42010
Library	libgnutls-openssl27 3.5.8-5+deb9u6	not_applicable open
Saiph	libgnutls-openssl27 3.6.7-4+deb10u12	not_applicable open

Same product CVEs in your queue

Other tickets that look like the same product (from match reason). Relate them here to triage this CVE as the primary.

CVE	CVSS	Systems	Status	Matched	Already related
CVE-2026-33845	7.5	Library, Saiph, morris, mufasa	accepted_risk, does_not_affect	gnutls	—
CVE-2026-1584	7.5	Library, Saiph, morris, mufasa	new	gnutls	—
CVE-2026-42009	7.5	Library, Matrix, Saiph, morris, mufasa	not_applicable	gnutls	→ CVE-2026-42010	linked here

Related CVE (same fix)

Point this ticket’s CVE at a higher-priority / same-fix primary so you only triage one.

Other CVEs related to this one as primary:

Related CVE	Note	Tickets
CVE-2026-42009	same product as CVE-2026-42010	morris, mufasa, Library, Matrix, Saiph

Host OS / kernel

Debian GNU/Linux 10 (buster) (10) · debian

Arch

x86_64

kernel_release

uname -r → 4.19.0-27-amd64

kernel_version

uname -v → #1 SMP Debian 4.19.316-1 (2024-06-25)

For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.

Same CVE on other hosts

Open the ticket for this CVE on another system.

System	Status	Priority	Updated
morris	not_applicable	7.71	2026-08-22T10:15:30Z	Open
mufasa	not_applicable	7.71	2026-08-22T10:15:30Z	Open
Library	not_applicable	3.36	2026-08-22T10:15:30Z	Open
Matrix	not_applicable	1.86	2026-08-03T17:04:51Z	Open

Description

A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.

Determination

CVE-2026-42010 is an authentication bypass in GnuTLS.

Practical Risk

This only affects systems that actually use RSA-PSK authentication with GnuTLS. If you are not using RSA-PSK, the practical impact is low, but the package itself remains vulnerable.
Quick Conclusion
Unless you (or an application you installed) have explicitly configured RSA-PSK authentication, you are very unlikely to be using it, and the practical risk of CVE-2026-42010 is low even though the library is technically vulnerable.

Update status

Add note only

Mitigation log

2026-08-03T03:23:58Z — reviewing

CVE-2026-42010 is an authentication bypass in GnuTLS. Practical Risk This only affects systems that actually use RSA-PSK authentication with GnuTLS. If you are not using RSA-PSK, the practical impact is low, but the package itself remains vulnerable.

2026-08-03T03:26:40Z

Practical Reality On a typical server (web hosting, mail, cPanel, etc.), RSA-PSK is almost never used. Most systems that have GnuTLS installed use it for normal certificate-based TLS (HTTPS, IMAPS, etc.), which is not affected by this CVE.

2026-08-03T03:27:38Z — not_applicable

Quick Conclusion Unless you (or an application you installed) have explicitly configured RSA-PSK authentication, you are very unlikely to be using it, and the practical risk of CVE-2026-42010 is low even though the library is technically vulnerable.

References

NVD: CVE-2026-42010