Gnutls: gnutls: authentication bypass via nul character in username

Summary

A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.

Timeline

1. May 7, 2026, 12:00 PM UTCCVE published
2. May 7, 2026, 1:47 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Oct 26, 2026, 5:03 PM UTCRecord last updated

Affected versions

• gnutls

  From 3.6.13 · fixed in 3.8.13

• gnutls

  Version range not reported

• gnutls

  Version range not reported

• gnutls

  Version range not reported

• gnutls

  Version range not reported

• libtasn1

  Version range not reported

• gnutls

  Version range not reported

• libtasn1

  Version range not reported

• gnutls

  Version range not reported

• libtasn1

  Version range not reported

• gnutls

  Version range not reported

• libtasn1

  Version range not reported

• gnutls

  Version range not reported

• libtasn1

  Version range not reported

• gnutls

  Version range not reported

• libtasn1

  Version range not reported

• gnutls

  Version range not reported

• gnutls

  Version range not reported

• gnutls

  Version range not reported

• gnutls

  Version range not reported

• openshift/ose-rhel-coreos-8

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• cert-manager/jetstack-cert-manager-acmesolver-rhel9

  Version range not reported

• cert-manager/jetstack-cert-manager-rhel9

  Version range not reported

• cert-manager/cert-manager-operator-rhel9

  Version range not reported

• cert-manager/cert-manager-operator-bundle

  Version range not reported

• cert-manager/jetstack-cert-manager-acmesolver-rhel9

  Version range not reported

• cert-manager/jetstack-cert-manager-rhel9

  Version range not reported

• cert-manager/cert-manager-istio-csr-rhel9

  Version range not reported

• cert-manager/cert-manager-operator-rhel9

  Version range not reported

• cert-manager/cert-manager-operator-bundle

  Version range not reported

• cert-manager/cert-manager-trust-manager-rhel9

  Version range not reported

• rhaiis/model-opt-cuda-rhel9

  Version range not reported

• rhaiis/vllm-cuda-rhel9

  Version range not reported

• rhaiis/vllm-rocm-rhel9

  Version range not reported

• discovery/discovery-server-rhel9

  Version range not reported

• discovery/discovery-ui-rhel9

  Version range not reported

• gnutls-main

  Version range not reported

• rhai/base-image-neuron-rhel9

  Version range not reported

• rhui5/cds-rhel9

  Version range not reported

• rhui5/haproxy-rhel9

  Version range not reported

• rhui5/installer-rhel9

  Version range not reported

• rhui5/rhua-rhel9

  Version range not reported

• rhui5/cds-kubernetes-tp-rhel9

  Version range not reported

• rhui5/installer-tp-rhel9

  Version range not reported

• rhui5/rhua-tp-rhel9

  Version range not reported

• gnutls

  Version range not reported

• gnutls

  Version range not reported

• openshift4/ose-hypershift-rhel9

  Version range not reported

References 25