Name Constraint Bypass in GnuTLS Allows Spoofing in Certificate Validation

CVE-2026-42011

What is CVE-2026-42011?

A critical flaw in the GnuTLS library allows attackers to bypass name constraints during certificate validation. The vulnerability stems from the incorrect handling of permitted name constraints when excluded name constraints are present from previous Certificate Authorities (CAs). By exploiting this weakness, an attacker could present invalid certificates, leading to risks such as spoofing and man-in-the-middle attacks on affected systems. It is crucial for affected users and organizations to update GnuTLS to secure their applications and maintain the integrity of their certificate validation processes.

References